The UK Supreme Court ruled in the case WM Morrison Supermarkets plc (Appellant) v Various Claimants (Respondents) [2020] UKSC 12, EWCA Civ 2339 on the circumstances in which an employer is vicariously liable for wrongs committed by its employees, and also whether vicarious liability may arise for breaches by an employee of duties imposed by the Data Protection Act (DPA) from 1998. In this case, Morrison, a supermarket group, is not to be held liable for data leak by an employee to the web and media, as the employee was not furthering Morrison's business, but pursuing a personal vendetta. This judgement opens the door for the dismissal of group action against Morrison filed by 100 000 employees whose payroll data was leaked.