Editorial
This edition of Information Technology Law Reports contains two cases concerned with the use and confidentiality of data. In the first, R (On the Application of C) v  Secretary of State for Work & Pensions, the Supreme Court emphasised the importance of transgender rights; the role and interplay between Article 3 and Article 8 of the European Convention on Human Rights; and how justification for an interference with the Article 8 right was not invariably justification for discrimination under Article 14. Interference with each right will need to be appropriately reasoned. The second case, Various Claimants v WM Morrisons Supermarket Plc, was concerned with when and how an employer can be liable to its employees for data protection law breaches. It was one of the first class-action type claims for data protection law breaches in the United Kingdom. Morrisons were held vicariously liable for the criminal actions of its rogue employee. The case makes it clear that employers can not simply avoid liability by demonstrating that appropriate measures have been implemented in accordance with data protection legislation. Given the introduction of General Data Protection Regulation in 2018, the potential impact of this case is highly significant.

Richard Budworth
Editor,Information Technology Law Reports

R (on the application of C) v Secretary of State for Work & Pensions
Supreme Court
Lady Hale, Lord Kerr, Lord Wilson, Lord Carnwath and Lord Hughes JJSC
1 November 2017
[2017] UKSC 72

Data retention – Department for Work and Pensions – administration of the welfare benefits system – gender reassignment – lawfulness of policies – Gender Recognition Act 2004 – Human Rights Act 1998 – Equality Act 2010 – appeal dismissed.

Various Claimants v WM Morrisons Supermarket PLC
High Court of Justice
Queen’s Bench Division 
Langstaff J 
1 December 2017
[2017] EWHC 3113

Data protection – breach of confidence – misuse of private information – vicarious liability – disclosure of information on the internet – wrongful conduct – section 4(4) Data Protection Act 1998 – judgment for the claimants.