The United Kingdom High Court recently issued a landmark liability judgment against the supermarket, Morrisons, following a data breach caused by a rogue employee (Various Claimants v. WM Morrisons Supermarket [2017] EWHC3113 (QB]). Similar results have been reached in the U.S., but this is the first time the UK Court has addressed the issue of whether an employer can be held vicariously liable under the UK’s Data Protection Act 1998 (DPA) (c 29) for a data breach committed by an employee. These kinds of cases are important reminders that irrespective of jurisdiction, malicious insiders, in particular disgruntled former employees, with access to data that external hackers can’t easily reach, often cause some of the most costly data breaches.

Morrisons

The press, in 2014, discovered that a Morrisons payroll file containing personal data of nearly 100,000 employees was uploaded to a public website. The employee personal data exposed included names, addresses, dates of birth, ID numbers, bank account information and salaries. Once Morrisons became aware of the breach, the supermarket took prompt action, removing the personal data from the website and cooperating with the public authorities and banks.

The payroll data was intentionally exposed by a senior IT auditor of Morrisons, Andrew Skeleton, who copied the data onto his personal USB before supplying the information to the supermarket’s external auditor. Skeleton allegedly acted in defiance against Morrisons due to a disciplinary incident from earlier in the year.

Consequently, in 2015 a UK county court convicted Skeleton of fraud, disclosing personal data and securing unauthorized access to computer matter, and sentenced him to eight years in prison pursuant to the DPA and the Computer Misuse Act 1990 (c 18).

Two years later, over 5000 employees brought a class action against Morrisons alleging that the supermarket breached it statutory duty under the DPA and at common law for breach of confidence and misuse of private information. The claimants contended that Morrisons was directly liable for breaching its statutory duty, and alternatively that it was vicariously liable for the breach as Skeleton’s employer.

Under the DPA, as a data controller Morrisons is required to comply with certain data principles among which include ensuring that ‘data shall be processed in accordance with the rights of data subjects’ (principle 6), and ‘appropriate technical and organizational measures shall be taken against unauthorized or unlawful processing of personal data’ (principle 7).

In respect to direct liability, the UK High Court held that Morrisons could not be directly liable as it had not breached the principles under the DPA, and had not breached the confidentiality of its employees or misused information.

Conversely, in respect to vicarious liability, the Court concluded that Morrisons could be liable for Skeleton’s actions on the basis that ‘there was a sufficient connection between the position in which Mr. Skeleton was employed and his wrongful conduct’.

Similar Cases in the U.S.

In the U.S., the doctrine of respondeat superior provides that an employer may be vicariously liable for the tortious acts of one of its employees, which generally applies only when the employee’s acts were committed in furtherance of the employer’s business and within the scope of employment. However, applying this rule to similar circumstances may yield different results.

In Doe v. Guthrie Clinic, Ltd., a nurse recognized that one of her employer’s patients being treated for a sexually transmitted disease (STD) was the boyfriend of her sister-in-law. The nurse accessed the patient’s medical records, confirmed he was being treated for the STD, and texted her sister-in-law about her boyfriend’s condition. The New York Court of Appeals held the employer medical corporation not liable because the employee’s action was not within the scope of her employment.

However, an Indiana appellate court upheld a $1.44M jury verdict holding a big box pharmacy liable for the actions of one of its employees, a pharmacist. In that case, the pharmacist improperly accessed the prescription history (birth control medication) of a patient who once dated the pharmacist’s husband. Here, conduct not unlike the facts in the Doe v. Guthrie Clinic, Ltd. case, was found by the jury and upheld by the court to be sufficient which the scope of employment.

Employer Takeaways

While the actions of a rogue employer can be unpredictable, there are steps employers can take to minimize risks associated with insider threats. Steps include:

• performing thorough and relevant background checks and periodically assessing employee behavior once hired;
• straight forward employee policies and training;
• systems that can limit access to data to the extent appropriate for the business and applicable law – even though an authorized user can abuse their access as in Morrisons, limiting access allows an employer to pinpoint who accessed sensitive data in the case of an incident;
• ensuring best practice for account protection (e.g. frequently changing password, unique and strong passwords)
• acting promptly and effectively if an incident occurs.

With the looming EU General Data Protection Regulation (GDPR) that will heighten data privacy and security obligations for employers both based within the EU and outside of it (see our article Does the GDPR Apply to Your US-based Company?), companies should be assessing their data security measures to ensure GDPR compliance, which will in turn minimize the risks associated with insider threats.