You may remember in 2014 that Morrisons senior auditor, Andrew Skelton, leaked the payroll data of 100,000 of Morrisons' staff to newspapers - names addresses, salary details. Crazy stuff, and definitely not part of the Morrisons employee handbook. Skelton went to prison, and you may have thought that was the end of that. Not so. A class action was taken by 5000 employees holding Morrisons responsible for the breach. Morrisons argued that they could not be held liable for the criminal actions of a former employee and Morrisons were not blamed by the courts for the way it protected personal data. Nonetheless the High Court and subsequently the Court of Appeal agreed with the 5000 - where staff had been obliged to hand over sensitive (special category) data they had a right to expect it to remain confidential, thus killing the "wasn't me" defence. Next stop - Supreme court, but only if they agree to hear it. Business beware.
