Employment Case Law Update: Vicarious Liability

The case of Morrisons v Various Claimants has been one we have reported on several times as it has moved from the High Court to the Court of Appeal, and now the Supreme Court has ruled that an employer cannot be held to be liable for a data breach where an employee commits the breach as a personal vendetta.

This case involved an employee of Morrisons, Mr Skelton, who was a senior internal auditor for the company. In 2013, a disciplinary process was instigated against Mr Skelton for an allegation of minor misconduct and he was given a verbal warning. After this, he held a grudge against his employer.

Morrisons then had an external audit of their accounts and in preparation for this the auditors requested sight of the payroll data for the company to test their accuracy. This task was delegated to Mr Skelton as he had carried it out in previous years. He was then given access to the payroll data relating to the whole of the Morrisons’ workforce which totalled around 126,000 employees. The data he was given access to included the name, address, gender, date of birth, phone numbers, national insurance number, bank sorting code, bank account number and salary of each member of staff.

During the task of collating the data, it was found that Mr Skelton had searched for software with the ability to disguise the identity of a computer which accessed the internet. He later made a request for the data and this was provided to him. He then sent this data to the auditors as per his instructions. However, before he did so, it was discovered that he had copied the data from his work computer to a personal USB stick.  He later used the name and date of birth of another Morrisons employee to create a false account and to frame him.

He then uploaded the data he had copied to a public file sharing website. Mr Skelton had made this disclosure whilst he was at home, using a pay as you go mobile phone, the false email account and the disguising software he had downloaded. He then deleted all the data from his possession.

On the day that Morrisons’ financial results were to be announced, Mr Skelton sent the data anonymously to three UK newspapers. One of the newspapers then alerted Morrisons who took steps to delete the data, carried out an internal investigation and informed the police and their employees.

Mr Skelton was arrested and sentenced on a number of offences.

Employees of Morrisons who had their data published then brought a claim against Morrisons for a breach of the statutory duty imposed by the Data Protection Act 1998 as well as misuse of private information and breach of confidence. Their claims went through the High Court and the Court of Appeal and were successful.

Morrisons appealed to the Supreme Court who overturned the rulings of the High Court and Court of Appeal, finding that Morrisons were in fact not liable for Mr Skelton’s act. The Supreme Court held that they couldn’t be held liable through vicarious liability because the act was a “frolic of his own” and not “furthering his employer’s business”.  They also ruled that an employer cannot be held liable for the actions of their employees if the act is not “closely connected” to their everyday duties; in this case, disclosing the personal information was not part of Mr Skelton’s “field of activities” that was in his remit.

The Supreme Court’s judgment compared a Managing Director at a Christmas Party who punched an employee when illustrating who was in charge of the business. They stated an employer would be liable in that instance.

This case illustrates that even when an employee commits an act of misconduct or a breach of the law, the employer may not be held vicariously liable where the act is an act of personal vengeance.

If you have any questions regarding this article, or you would like guidance on vicarious liability or data protection, you can call our Employment team today on 023 8071 7717 or email employment@warnergoodman.co.uk.

This was previously part of our weekly Employment Law Newsletter. If you would like to subscribe, please email us at events@warnergoodman.co.uk or just fill in our subscription form.

ENDS

This is for information purposes only and is no substitute for, and should not be interpreted as, legal advice.  All content was correct at the time of publishing and we cannot be held responsible for any changes that may invalidate this article.