UK Supreme Court delivers good news for risk managers in Morrisons and Barclays cases

Risk managers will welcome two long-awaited rulings from the UK Supreme Court in cases against Morrisons and Barclays that will reduce the exposure of corporates going forward. Both cases involved the responsibility of the corporate for the actions of an individual employee. Morrisons workers whose payroll details were leaked by a disgruntled employee will not receive compensation, the Supreme Court has ruled, deciding the chain was not liable after an internal auditor leaked payroll data of about 100,000 workers as revenge. And Barclays Bank has won its Supreme Court challenge on liability for any sexual assaults committed by a doctor who carried out medicals on its behalf. As one lawyer said: “Common sense has prevailed in the Morrisons case as the appeal has been allowed, which will be a huge relief for the cyber market. And in Barclays, the court has also restricted the expansion of vicarious liability, so good news for corporates all round.” In the Barclays case, Greg Woods, partner at global law firm Kennedys who heads up the employers’ and public liability group, noted: “This judgment will come as a blow to Dr Bates’ alleged victims, who will now not be compensated by Barclays for his allegedly abusive conduct. “From a legal perspective, it clarifies the court’s approach to determining whether the relationship between an employer and contractor is sufficiently akin to an employment relationship, to make it right to hold the employer liable for the contractor’s actions.” In the Morrisons case, he noted: “Morrisons, or rather its insurers, could have faced a bill of at least £10m in compensation if they had had failed in their attempt to overturn this judgment and it would have represented a disturbing extension in the law of vicarious liability. “However, despite Morrisons winning this case, it should still serve as a wake-up call to businesses to have robust data protection policies in place to ensure, so far as possible, they are not victims of a similar breach.” Greig Anderson, a partner in Herbert Smith Freehills insurance disputes group, agreed that it was good news – up to a point. “The good news for concerned corporates is that they can buy cyber insurance to cover data breach claims, whether for direct or vicarious liabilities, as well as related losses such as costs of managing the incident, regulatory investigations and loss of profits if systems are impacted. However, risks transfer strategies within corporates vary and that cover cannot necessarily be banked on in all cases. “The main challenge therefore remains – and is not answered here – how much cover would I need to buy for a reasonable worst case and is that available at reasonable cost on a good wording? Given that the measure of damages is still unclear, this issue will continue to be wrestled with.” Miriam Everett, partner and global head of data and privacy at Herbert Smith Freehills, added: “Today’s judgment will lead to a collective sigh of relief in boardrooms up and down the country as this is exactly the decision that many organisations wanted. “In a world where companies can already be fined up to €20m or 4% of annual worldwide turnover for GDPR non-compliance, there are real fears concerning the potential for additional significant liability under class action claims for data breaches.” “However, the decision is no guarantee that similar claims would fail in circumstances where the regulator agrees that there has been a breach of the security requirements under the GDPR, such as has been the case when you look at some of the recent big data breaches we have seen, which are starting to result in significant fines from the ICO.” But it is unlikely to stop class actions totally. Julian Copeman, a partner in Herbert Smith Freehills disputes practice, said: “Data breach class actions are on the rise in the UK and today’s judgment should be seen as a setback not a roadblock. Funders and claimant firms are looking to build class actions in relation to data breaches even where there is no specific evidence of individual damage. “They are seeking damages for the whole class for ‘distress’ or a standardised claim of loss of access to data and even a nominal damages award per claimant could lead to a significant amount over a class of tens or hundreds of thousands.”

UK Supreme Court delivers good news for risk managers in Morrisons and Barclays cases

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles