Morrisons Supermarket

Although a recent U.K. Supreme Court decision was a victory for limited corporate liability, lawyers say upcoming cases will fully frame the approach courts will take to data breach litigation in the country.

On April 1, the U.K. Supreme Court reversed a lower court's ruling that found supermarket chain Morrisions vicariously liable for the 2014 breach of nearly 100,000 employees' data after a disgruntled employee uploaded workers' personal information online. Vicarious liability is U.K. common law that extends liability to a company for an employee's actions. 

However, the Supreme Court unanimously rejected extending vicarious liability to Morrisons for the actions of its then-senior auditor, a welcomed decision in U.K. corporate law.

"The Supreme Court placed particular importance on the fact that the employee in this case was not authorized to upload the data to a publicly accessible platform as part of his duties at the company," wrote Bird & Bird associate Theo Rees-Bidder in an email. The Supreme Court also found "that in uploading the data, he was acting for purely personal reasons and not on the business of his employer."

However, Rees-Bidder noted the Supreme Court didn't agree with Morrisons' argument that the U.K.'s Data Protection Act excluded vicarious liability for misuse of private information.

"The Supreme Court also clarified that, as a matter of principle, employers can be held vicariously liable under data protection legislation for the acts of employees who—in performing their role—are data controllers, so long as the test for vicarious liability can be satisfied on the facts of the individual case (which it was not in Morrisons' case)," he noted.

While the Morrisons case provides some clarification on corporate breach liabilities, DLA Piper global privacy co-chairman Andrew Dyson noted there are other legal matters winding through the U.K. court system that will also shape its data breach law.

Dyson cited Lloyd v. Google as an important case to watch. In October 2019, the U.K. Court of Appeal ruled in that case that damages can be awarded for a loss of control of data even when financial loss or damages weren't alleged. Magic Circle firm Freshfields Bruckhaus Deringer wrote that Lloyd could open the "floodgates" for similar data privacy damage claims.

Additionally, the Atkinson v. Equifax representative action was another closely watched "loss of control" lawsuit that was filed in December 2019 over Equifax's massive 2017 data breach. However, earlier this month, the claimant suing Equifax withdrew from the case, according to reporting by Globaldatareview.com.

However, similar cases would help companies and barristers determine the economic risk or reward of bringing a data breach group action to court, Dyson said.

"That's why these cases are interesting, they're testing the appetite of the court to all these group claims in the court," Dyson said. "So far they have been pretty resistant at least at the Supreme Court level. … But the landscape is still being defined. There are law firms coming up with these cases in the vacuum of cases to get compensation from companies because they don't know what the landscape is."

Still, as the U.K. legal system grapples with data breach civil claims, Morgan, Lewis & Bockius data privacy, employment and cybersecurity partner Pulina Whitaker argued that Morrisons was a "landmark" case that created a "tested forum" for data breach group litigation.

"Once it got approval from the High Court, it's a tested mechanism for affected data subjects to bring actions against that controller as a group," she said.