In a landmark ruling, the UK’s highest court has cleared UK supermarket Morrisons of vicarious liability for the actions of a rogue employee – but claimants in other cases may still be able to hold data controllers indirectly liable.

https://globaldatareview.com/cybersecurity/morrisons-not-liable-rogue-employee-data-breach