Morrisons' Supreme Court Appeal Successful On Vicarious Liability For Data Theft By An Employee

The Supreme Court has found that the supermarket chain Morrisons was not vicariously liable for the actions of a rogue employee who, driven by a grudge against the company, took payroll data relating to 100,000 employees and published it online.

Background

Mr Skelton, a disgruntled employee of Morrisons, leaked the personal details (including bank account details) of almost 100,000 employees on the internet. He was a senior IT auditor and had been motivated by a grudge against Morrisons. The High Court concluded that Morrisons was not directly liable for the breach, which it had not authorised or required, and it was not the "data controller" at the time of the breach. It said that Morrisons had put in place adequate and appropriate controls and there was no indication that Mr Skelton, although upset by recent disciplinary action, could not be trusted to do his job. There was no appeal from that decision. However, the judge found that Morrisons was vicariously liable for the breach - and they appealed against that decision.

The Court of Appeal dismissed their appeal. It agreed that, on the facts, the High Court was correct to find that there had been a "seamless and continuous sequence" of events between the breach and the employment relationship. Dealing with the employees' data was a task specifically assigned to Mr Skelton. Nor did it make any difference that the breach took place away from the workplace, using the employee's own computer on a Sunday.

The Court of Appeal also agreed with the High Court that it is possible for an employer to be held vicariously liable for breaches by an employee of the data protection legislation.

Supreme Court decision

There were two key issues for the Supreme Court to decide:

Was Morrisons vicariously liable for the employee's conduct? Was vicarious liability excluded under the data protection legislation? On the first issue, the Supreme Court allowed the appeal. It said that the Court of Appeal had misunderstood the principles of vicarious liability, and in particular the "close connection" test.

The "close connection" test can be broken down into two questions:

What was the function or field of activities that the employer had entrusted to the employee? Was there sufficient connection between the position in which he was employed and his wrongful conduct to make it right for the employer to be held liable under the principle of social justice? The Supreme Court clarified the following points:

Field of...