An employee disclosed personal data of around 5,000 employees including salary and bank details to a newspaper and online. Morrison’s was held to be vicariously liable for the data breach in the High Court and in the Court of Appeal, even though it could not be said that the employee was acting in the course of his employment.
This decision has now been reversed by the Supreme Court.
The Facts
Mr Skelton was employed by Morrison’s as an internal IT auditor. He was issued with a verbal warning for minor misconduct which resulted in him developing a grudge against his employer. This grudge culminated in him copying the payroll data for the entire of Morrison’s workforce onto a USB stick which he took home and posted the data on the internet. He also sent this data to three national newspapers, claiming to be a concerned member of the public.
9,263 of Morrison’s employees or former employees issued proceedings in the High Court against them for damages for:
- misuse of private information;
- breach of confidence; and
- breach of Morrison’s statutory duty under the Data Protection Act 1998 (applicable at the time) in relation to its failure as a data controller to comply with the eight data protection principles.
The Claimants alleged that Morrison’s was either primarily liable under those heads of claim or vicariously liable for Mr Skelton’s wrongful conduct.
The High Court held that there was a sufficient connection between the position in which Mr Skelton was employed and his wrongful conduct to justify holding Morrison’s vicariously liable for his actions.
Morrison’s appealed to the Court of Appeal who dismissed the appeal ruling that:
- The High Court had been right to conclude that Mr Skelton was entrusted with the payroll data and that his tortious acts in sending the data to third parties was within the field of activities assigned to him by Morrison’s (i.e. it was in the course of his employment).
- The motive for an employee’s act was irrelevant such that a finding of vicarious liability was not prevented by the fact that Mr Skelton was trying to harm his employer.
- The common law remedy of vicarious liability for misuse of private information and breach of confidence was not expressly or impliedly excluded by the DPA 1998 (Morrison’s had argued this point as part of their appeal).
Decision
The Supreme Court has now overturned the decision of the High Court ruling that in coming to its conclusion the Court of Appeal had taken out of context comments made by the Supreme Court in a previous case relating to vicarious liability (Mohamud v Wm Morrison Supermarkets plc).
The Supreme Court has clarified that for vicarious liability to arise the wrongful conduct had to be so closely connected with acts the employee was authorised to do that, for the purposes of the liability of the employer to third parties, it might fairly and properly be regarded as done by the employee while acting in the ordinary course of their employment. This test was set out by the House of Lords (as the Supreme Court was previously known) in Dubai Aluminium Co Ltd v Salaam [2002]
The Supreme Court found that the Court of Appeal had misunderstood the principles governing vicarious liability. In particular:
- The disclosure of the data on the internet “did not form part of Mr Skelton’s functions or field of activities”. This was “not an act which he was authorised to do”.
- Although there was “a close temporal link and an unbroken chain of causation linking the provision of the data to Mr Skelton for the purpose of transmitting it to KPMG and his disclosing it on the internet, a temporal or causal connection does not in itself satisfy the close connection test”.
- The “reason why Mr Skelton acted wrongfully was not irrelevant…whether he was acting on his employer’s business or for purely personal reasons was highly material”.
The Supreme Court referred to the distinction drawn in previous case law between
“cases … where the employee was engaged, however misguidedly, in furthering his employer’s business, and cases where the employee is engaged solely in pursuing his own interests: on a ‘frolic of his own’, in the language of the time-honoured catch phrase.”
The Supreme Court said that:
“it is abundantly clear that Skelton was not engaged in furthering his employer’s business when he committed the wrongdoing in question. On the contrary, he was pursuing a personal vendetta, seeking vengeance for the disciplinary proceedings some months earlier.”
In those circumstances, the Supreme Court concluded that:
“Mr Skelton’s wrongful conduct was not so closely connected with acts which he was authorised to do that, for the purposes of Morrison’s liability to third parties, it can fairly and properly be regarded as done by him while acting in the ordinary course of his employment.”
What does this mean for you?
Employers are liable for the actions of their employees if there is a close enough connection to their work and the role they are employed to do. Clear job descriptions, policies and training making it clear what is and is not acceptable can help defend such claims. This is particularly important where an employee has access to significant amounts of personal data. We can assist you in reviewing and updating contracts and policies or provide training on data protection to your employees in respect of their obligations to help you reduce your risk.
0 Comments