http://www.insider.co.uk March 2020 INSIDER 111INSIDER:PERSONNEL
The latest news from HR, recruitment, employment law
and staff issues by Ken SymonEmployers await ruling on data case
L
ATER this year the UK Supreme
Court will give its ruling on a case
that will have a significant impact on
data breaches in the workplace.
In the case William Morrison
Supermarkets is trying to overturn a
Court of Appeal verdict in a case that could
cost it dearly.
Various Claimants v Wm Morrison
Supermarkets plc was the first group litigation
to be brought in the UK following a data
breach. At its heart is Andrew Skelton, a
former employee of the supermarket group.
Skelton had been disciplined after a white
powder was found in the company’s mail
room. Police had thought that this substance
might have been an illegal drug.
Lab tests eventually showed the powder to
be a legal slimming supplement, for which
Skelton had been running a business on the
side. He was, nonetheless, given a verbal
warning and suspended from his job for six
weeks. As a result of this, Skelton apparently
formed a grudge against Morrisons.
In November 2013, whilst helping KPMG
with their annual audit of the supermarket’s
accounts, the payroll of nearly 100,000
employees was uploaded from an encrypted
USB on to Skelton’s encrypted work laptop by
another employee of Morrisons. Skelton then
sent the data to KPMG.
A few days later, Skelton copied the payroll
data on to a personal USB stick. This was
done without the knowledge of his employer.
The audit had been completed by mid-
December. Skelton, however, continued to
retain the payroll data on his personal USBstick and, in January 2014, posted it on a
file-sharing website. He also alerted three
newspapers, which contacted the police.
Skelton was arrested, charged with a
number of offences and sentenced to eight
years in prison
So the issue was whether the Data
Protection Act excludes vicarious liability
being applied to a breach of the Act or
misuses of private information or a breach
of confidence. And so whether the Court of
Appeal erred in its ruling.
Emma Allan, an associate in the
commercial department at solicitors Miller
& Henry says: “The Court of Appeal found
that the supermarket was vicariously liable
even though Skelton had acted in a deliberate
attempt to damage his employer, and despite
the fact the company was itself compliant
with the data protection legislation.
“It is worth noting that this case involves
the law before the General Data Protection
Regulation (GDPR) came into force on 25
May 2018.
“As GDPR increased the rights of data
subjects, employers will be concerned that
a Supreme Court finding against Morrisons
will result in a large increase in data breach
class actions.
“The judgment of the Supreme Court is
eagerly awaited, and will undoubtedly have
far-reaching ramifications for employers
across the country, effectively deciding
whether or not the Data Protection Act 1998
excludes an employer from being vicariously
liable for a data breach committed by
an employee.” ■COMMENT
Most employers will be aware that in
order not to fall foul of unfair dismissal
law they should investigate all disciplinary
allegations properly before proceeding
to dismiss. However a recent case
has considered whether a separate
investigation meeting is a right in itself.
The facts of the case involved a hotel
night porter who was dismissed after being
found asleep while on duty. The employer’s
investigation consisted of reviewing CCTV
footage, and having done so it proceeded
to invite the employee to what it called
an investigation meeting. Except it wasn’t
really, and the employee was dismissed at
that meeting.
Adjudging the employee’s claim of unfair
dismissal, the Employment Tribunal was
critical of the fact the employer failed to
hold separate investigation meetings and
disciplinary hearings. It viewed that issue as
a serious procedural failure which rendered
the dismissal unfair.
However the Appeal Tribunal did
not agree. In its opinion, there was no
standalone requirement for there to be a
separate investigation meeting. But, said
the Appeal Tribunal, the Employment
Tribunal hadn’t found that that procedural
failure was the only reason for finding
the dismissal unfair. The Employment
Tribunal had correctly concluded that on
the facts of the case there had been a lack
of proper investigation overall and a lack
of opportunity to prepare for a disciplinary
hearing which rendered the dismissal
procedurally unfair.
This case is a useful reminder that
for the purposes of unfair dismissal
law, an employer should carry out as
much investigation into the matter as
is reasonable in all the circumstances of
the case. Some cases will be reasonably
cut and dried, requiring a relatively basic
investigation; more complex cases will
require a deeper investigation. Either way
however, there is no absolute requirement
to hold a separate investigation meeting
with the accused employee. Though do
check your employee handbook in case it
says otherwise!If you have any questions on the above
article, please contact 0333 2400 308 or
[email protected]Alan Sutherland
Head of Employment Law
T: 03332 400 308
E: alan.sutherland@
navigatorlaw.co.uk
W: http://www.navigatorlaw.co.ukDisciplinary investigations