On 1 April 2020, the Supreme Court handed down judgment[1] in an eagerly awaited appeal by Morrisons Supermarket, ruling that it was not liable for the criminal acts of a rogue employee. The court’s unanimous decision will have data controllers everywhere breathing a sigh of relief.