Vicarious liability for employers: mere opportunity does not in itself confer liability

On 1 April 2020 the Supreme Court gave judgment in WM Morrison Supermarkets v Various Claimants.

The case concerned a group action brought by just over 9,000 current and former employees of Morrisons. Some of their personal and financial information was, briefly, published on the internet by employee Andrew Skelton; a senior auditor.He did this because he harboured a grudge against his employer following earlier disciplinary proceedings for minor misconduct. Fortunately the data was only available on the internet for a few hours and Skelton was later convicted and imprisoned. Morrisons spent more than £2.26 million dealing with the aftermath of the disclosure.

The key issue before the Courts in this appeal was whether the Defendant was vicariously liable for their employee Skelton’s conduct. Was that conduct sufficiently closely connected with acts he was authorised to do to render his employer liable? The Supreme Court concluded that it was not.

In this case:

• The disclosure of the data on the internet did not form part of Skelton’s field of activities. It was not an act he was authorised to do.

• Although there was an unbroken chain of causation linking the provision of data to Skelton and his ultimate decision to disclose it on the internet that would not in itself satisfy the close connection test.

• The mere fact that Skelton’s employment gave him the opportunity to commit a wrongful act would not be sufficient to warrant imposition of vicarious liability. All the relevant case law illustrated a distinction between “cases … where the employee was engaged, however misguidedly, in furthering his employer’s business and cases where the employee is engaged solely in pursuing his own interests”. In this particular case it was clear that Skelton was pursuing a personal vendetta.

This personal vendetta, combined with the Court’s analysis of both:

• The field of activities that had been entrusted to Skelton and

• Whether there was sufficient connection between his role and his wrongful conduct,

led the Supreme Court to conclude that in this case Skelton’s actions could not be fairly and properly regarded as done by him while acting in the ordinary course of his employment. Morrisons were not therefore liable for Skelton’s conduct.

The Application of the Data Protection Act

The Supreme Court concluded that the DPA does not exclude the imposition of vicarious liability either for statutory torts committed by an employee data controller or for misuse of private information and breach of confidence. Since the Data Protection Act neither expressly nor impliedly indicates otherwise, the principle of vicarious liability applies to the breach of obligations which the Act imposes.

Implications for Employers dealing with Vicarious Liability Claims

In this case the fact that this was a personal vendetta of Skelton’s own was relevant. It was abundantly clear that Skelton was not engaged in furthering his employer’s business when he committed the wrongdoing in question. The tortious action was not so closely connected with his employment to render Morrisons liable.

So, what are the key points to take away for employers facing vicarious liability claims?

First, for organisations in the health and social care sector it is important to note that the Supreme Court explicitly observed (at paragraph 23 of this Judgment) that the general principle that wrongful conduct must be so closely connected with the acts of the employee that it may be fairly and properly regarded as done while acting in the ordinary course of employment is differently applied in cases concerning the sexual abuse of children. In those cases the Courts have emphasised the importance of criteria that are particularly relevant to abuse, such as the employer’s conferral of authority on the employee over the victims.

Second, is that in every case, it is going to be necessary to:

• Establish the specific acts each employee was authorised to do during the course of their employment; and then

• Assess whether the tortious act was so closely connected with the acts the employee was authorised to do that for the purposes of vicarious liability the act might fairly and properly be regarded as being done by them whilst acting in the ordinary course of the employment. Mere opportunity to commit the wrongful act will not be sufficient to warrant the imposition of vicarious liability

That means that a careful examination of the facts, not only of the subject matter of the claim itself, but of the nature of the employment of the tortfeasor will be necessary in every case.

Sadly this decision does not make it more likely that similar cases will be susceptible to early applications to strike out.