In a landmark judgment, important from both a data protection and employment law standpoint, the Supreme Court has held that vicarious liability cannot be imposed on Morrisons in a case which concerned the unlawful publication of Morrisons’ employee personal data online by a rogue employee.
The case involved a class of 9,263 Morrisons employees or ex-employees whose personal data had been unlawfully made available online back in 2013. The information (which included name, address, gender, date of birth, phone numbers, national insurance number, bank sorting code, bank account number and salary) was published by a rogue employee, Mr Andrew Skelton, as an act of vengeance against Morrisons due to a grudge he held against his employers for disciplinary action taken against him earlier that year. Whilst Mr Skelton was entitled to access the data as part of his role, he was only permitted to share the data with the company’s auditors.
The claims brought against Morrisons were made under the Data Protection Act 1998 (DPA), under common law for misuse of private information and breach of confidence, and also on the basis that Morrisons were vicariously liable for the acts of Mr Skelton. Damages were sought for the distress, anxiety, upset and damage which had been suffered by the data subjects concerned.
The court noted that Morrisons had also spent more than £2.26m in dealing with the immediate aftermath of the disclosure. A significant element of that sum was spent on identity protection measures for its employees. Meanwhile, Skelton, the employee, was convicted of a number of criminal offences and sentenced to eight years’ imprisonment.
High Court and Court of Appeal decisions
In 2017, the High Court found in favour of the claimants, ruling (among other matters) that Morrisons could be held vicariously liable for the acts of Mr Skelton since he had been provided access to the relevant data in the course of his duties as an employee and his publication of the data was “a seamless and continuous sequence of events” relating to his duties. Furthermore, it was held that there was nothing which would prevent vicarious liability from applying under the DPA. Morrisons appealed to the Court of Appeal but were unsuccessful and so further appealed to the Supreme Court which heard the case at the end of last year.
Supreme Court ruling
The Supreme Court’s decision covered the following key issues.
- Could Morrisons be vicariously liable for Mr Skelton’s conduct?
The court found that the decision of the High Court and Court of Appeal relating to vicarious liability had focused too heavily on the judgment of Lord Toulson in an earlier Supreme Court decision (Mohamud ) (coincidentally also involving Morrisons) in which a customer at a petrol station had been assaulted by an employee of the petrol station. Much had been made by the judges in the lower courts of Lord Toulson’s comments in that case that the decision of the employee had been connected to his employment and that his motives for assaulting the customer were “irrelevant”.
However, the Supreme Court found that Lord Toulson’s comments in the Mohamud judgement had been taken out of context and should not be construed as introducing new principles to the concept of vicarious liability. It ruled that the “close connection” test remained the appropriate test for determining whether vicarious liability could be imposed on an employer. Pursuant to the close connection test:
“…the wrongful conduct [of the employee] must be so closely connected with acts the employee was authorised to do that, for the purposes of the liability of the employer to third parties, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment.”
In the present case, the Supreme Court found that the “close connection” test was not met (despite there being a close temporal and causal link between Mr Skelton’s role and his publication of the data on the internet) for the following key reasons:
- The disclosure of the data on the Internet did not form part of Mr Skelton’s functions or field of activities – he was not authorised to disclose the relevant data to anyone other than KPMG.
- The motives of Mr Skelton in disclosing the data were important – the fact that he did so for personal reasons was “highly material”. Indeed, the reasons Mr Skelton had decided to publish the data was to cause harm to Morrisons due to his personal vendetta against the company.
- Does the DPA exclude vicarious liability for statutory torts committed by an employee who is acting as a data controller under the DPA?
Although not strictly necessary given the court’s finding that Morrisons could not be held vicariously liable based on the facts of the case, the court did give its views on the above question which are important from a data protection perspective.
It had been agreed by all parties that both Morrisons and Mr Skelton were independent controllers in relation to the data which was published online. In light of this, Morrisons had argued that it could not be held vicariously liable for the acts of Mr Skelton under the DPA since it had complied with its obligations as a controller under the DPA and Mr Skelton was acting as a separate controller when disclosing the data. Morrisons argued that the DPA did not allow for vicarious liability to be imposed on them for Mr Skelton’s actions as a controller.
However, the Supreme Court rejected this position, stating that since the DPA does not indicate (whether expressly or impliedly) whether the principle of vicarious liability applies to breaches of its obligations, an employer can be found vicariously liable for breaches which are committed by an employee who is acting as a data controller in the course of his or her employment.
The decision will be welcomed by business since it shows that employers will not generally be held liable for the acts of rogue employees acting outside their “field of activities”. However, it is important to bear in mind that the decision came down to the specific facts of the case. It is entirely possible that there could be cases where unauthorised disclosure of personal data by an employee results in an employer being held vicariously liable; an example could be an employee negligently leaving sensitive documents on a train on the way to a business meeting, or causing a data breach by failing to follow the company’s data security policies. As ever, implementing appropriate data security measures and policies and reinforcing the need for employees to follow such policies can help to reduce these risks.
The case is also the first to come before the Supreme Court involving a class action brought by data subjects for a violation of data protection rules. Notwithstanding the decision in favour of Morrisons, we expect class actions in relation to data breaches to become increasingly common.
Finally, although the case was brought under the (old) Data Protection Act, the position would not be any different under the GDPR and the new DPA.
Ben Nolan (solicitor, qualified in Scotland) and Nigel Miller (partner)