Morrisons liable for data breach say staff in High Court action

Thousands of Morrisons staff should be compensated for the “upset and distress” caused by their personal details being posted on the internet by a top auditor with a grudge, the High Court heard today.

Lawyers said the case - the first data leak class action in the UK - has potential implications for every individual and business in the country.

They are seeking to prove that Morrisons was liable for a huge data breach in 2014, when Andrew Skelton, then a senior internal auditor at the retailer’s Bradford headquarters, leaked the payroll data of nearly 100,000 employees - including their names, addresses, bank account details and salaries - putting it online and sending it to newspapers.

In July 2015 Skelton was found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material and disclosing personal data. He was jailed for eight years.

The trial heard that his motive appeared to have been a grudge over a previous incident, where he was accused of dealing in legal highs at work.

Today Jonathan Barnes, counsel for 5,518 former and current Morrisons employees, told Mr Justice Langstaff at the High Court in London that the company had already been awarded £170,000 compensation against Skelton.

He added that the trial judge said that Skelton wanted to do Morrisons “some real damage”.

“The judge was sure that the employees were victims too, and it is those victims who have received no compensation for their distress or loss of control of the situation,” Mr Barnes said.

He said that it was a “simple complaint” by the employees who were required to provide the information when they joined Morrisons.

“We say that, having entrusted the information to Morrisons, we should now be compensated for the upset and distress caused by what we say was a failure to keep safe that information.”

The employees claim the leak exposed them to the risk of identity theft and potential financial loss and that Morrisons, which denies liability, is responsible for breaches of privacy, confidence and data protection laws.

The trial, which is concerned only with liability, is due to last two weeks.