There's no good answer to this one. Punishing the company for his actions isn't right, nor is it right that genuine damages to the data subjects would go uncompensated.
Perhaps a pragmatic approach would be for the damages to be treated as separate liabilities (on a percentage basis for blame as attributed by the judge), but with Morrissons having to front the damages attributable to their ex-employee as a loan if he is unable to pay. Morrissons may end up out of pocket, but the actual perpetrator ends up with a garnished income that would follow him around from then on - making him face the financial penalties as well as the criminal penalties for what he's done. Not a perfect answer by any means, but better than just hitting Morrissons.
Biting the hand that feeds IT
