U.K. supermarket chain Morrisons has lost its appeal to overturn a 2017 judgment that found it “vicariously liable” for a malicious data breach that saw a disgruntled former employee release the personal and financial details of nearly 100,000 staff. The company says it will now take the battle to the Supreme Court.
Morrisons had argued it could not be held liable for the criminal misuse of its data, but three U.K. Court of Appeal judges rejected the company’s appeal and upheld the original December 2017 decision, finding that while Morrisons was not directly liable for the data breach, the company was “vicariously liable” for the rogue employee’s actions as he had control of the data and was acting in the course of his employment.
