Report comment

No, it just means they need to look after data and insure against the risk of something like this happening. Morrisons will be insured and presumably it is those insurers who are funding Morrisons' defence to these claims.

If a solicitor put his/her employee in a position where the employee can (and does) steal the client's money, the solicitor is almost certainly going to be answerable for that.
If a dry cleaner's employee steals a customer's mink stole while it is in for cleaning, the dry cleaner is almost certainly going to be liable. If a school teacher sexually abuses his pupils, the school is almost certainly going to be liable.

Why should Morrisons' position be any different? The fact that Morrisons did not condone the conduct (and that the employee's act was criminal or malicious) makes no difference (and does not invalidate the relevant insurance cover).