Morrisons are responsible for the actions of their employees
If you follow that logic to its conclusion it expalins MGM suing the victims of the mass shooting in Las Vegas.
In practice, I would hope responsibility would depend on the extent to which Morrisons were negligent in exercising reasonable controls to prevent such incidents happening. And in that respect, I'm far more concerned that KPMG felt entitled to an entire copy of the company's payroll, without any form of obfuscation, and that their request went apparently unchallenged.