Morrisons faces biggest-ever UK data breach class action at High Court

More than 5,000 Morrisons employees involved in a huge online data leak will be at the centre of a landmark High Court case in London next month.

The claimants are seeking compensation from the supermarket giant over a breach of data security in 2014, when a former senior internal auditor at the retailer’s Bradford headquarters posted payroll information of nearly 100,000 staff on the internet. This included bank, salary and National Insurance details, addresses and phone numbers.

Andrew Skelton, an ‘insider’ who bore a grudge against his employer, was later jailed for eight years following a trial at Bradford Crown Court, which heard he sent the information to local and national newspapers and placed it on data sharing websites.

A total of 5,518 current and former Morrisons staff are pursuing a claim for damages after the High Court made a Group Litigation Order in 2015.

A trial to determine liability for the data leak is due to start at the High Court in London on Monday, October 9 and is scheduled to last for two weeks.

The case is the first data leak class action in the UK and is believed to be the biggest-ever claim in relation to a data breach in the UK. It comes amid growing concerns about cyber-security.

The case will take place against the background of a planned overhaul of UK data protection laws, with a government Bill due to be published this month.

The claimants say Morrisons failed to prevent the leak, which they argue exposed employees to the risk of identity theft and potential financial loss and was ultimately legally responsible for breaches of privacy, confidence and data protection laws. Morrisons denies all legal liability.

If the High Court rules that Morrisons is liable for the data leak, there would then be a further ‘quantum’ trial to assess the victims’ damages.

Nick McAleenan, a partner and data privacy law specialist at JMW Solicitors, who will represent the claimants, said: “At the trial in October, the court will decide whether Morrisons bears any legal responsibility for the misuse and disclosure of the payroll information of the many thousands of people bringing claims in this case.”