The High Court ruling means some 5,518 former and current workers who brought the liability claim against Morrisons for the worry and stress caused can now seek compensation, although the supermarket said it would appeal the judgement.
They brought the claim against Morrisons, which is based in Bradford in the north of England, after the theft and publication of the data in 2014 by finance worker Andrew Skelton, who was later jailed for his offences.
“We welcome the judgment and believe that it is a landmark decision, being the first data leak class action in the UK," said Nick McAleenan, a partner at JMW Solicitors, who represented the claimants.
Justice Langstaff ruled that Morrisons was not at fault in the way it protected the staff data, but it was responsible for Skelton's actions as he was its employee.
The judge said he was, however, troubled that his conclusion of "vicarious no fault liability" could render the court an accessory to furthering Skelton's aim of damaging Morrisons.
He therefore granted Morrisons leave to appeal his ruling so that a higher court could consider it.
A spokesman for Morrisons said it had worked to get the data taken down quickly, provided protection for affected colleagues and reassured them they would not be financially disadvantaged.
He said Morrisons was not aware that any employee suffered any direct financial loss and would appeal the judgement.
(Reporting by James Davey; editing by Alexander Smith)
By James Davey
