The UK's highest court has ruled that Morrisons should not be held liable for the criminal act of an employee with a "grudge" who leaked payroll data of around 100,000 members of staff.
The supermarket giant brought a Supreme Court challenge in a bid to overturn previous judgments which gave the go-ahead for compensation claims by thousands of employees whose personal details were posted on the internet.
A panel of five justices unanimously ruled on Wednesday that Morrisons was not "vicariously liable" for the actions of Andrew Skelton, who disclosed staff information on the internet and also sent it to newspapers.
Announcing the decision via livestream, the court's president Lord Reed said Skelton leaked the data because of a "grudge" after he was given a verbal warning following disciplinary proceedings.
The judge said employers could only be held liable for the actions of employees if they were "closely connected" with their duties at work.
He said: "In the present case, Skelton was not engaged in furthering Morissons' business when he committed the wrongdoing in question.
"On the contrary, he was pursuing a personal vendetta, seeking revenge for the disciplinary proceedings a month earlier.
"In these circumstances, applying the established approach to cases of this kind, his employer is not vicariously liable."
The decision overturns previous rulings in the High Court and Court of Appeal, which held that Morrisons was vicariously liable for Skelton's actions.