Supreme Court Overturns Morrisons Judgment On Data Breach By Rogue Employee

• Published date: 29 March 2021
• Subject Matter: Employment and HR, Privacy, Employment Litigation/ Tribunals, Employee Rights/ Labour Relations, Data Protection
• Law Firm: Cleaver Fulton Rankin
• Author: Mr Nathan Campbell

Background

In October 2013 Andrew Skelton, a disgruntled employee of Morrison Supermarkets plc, posted the personal details of nearly 100,000 employees of Morrisons online. These details included the name, address, gender, date of birth, phone numbers, national insurance number, bank sorting code, bank account number and salary of each member of staff. Mr Skelton had access to this data for the legitimate purposes of transmitting it to external auditors but ultimately his actions, which he had attempted to frame a co-worker for, were discovered and he was sentenced to eight years' imprisonment.

Subsequently over 9,000 of the victims of Mr Skelton's data breach sued Morrisons for breach of statutory duty under the Data Protection Act 1998, misuse of private information and breach of confidence on the basis that it was vicariously liable for the actions of its employee. The claimants were successful both in the High Court and in the Court of Appeal. However, the Supreme Court has recently overturned these judgments on the basis that they had misunderstood the principles governing vicarious liability.

Examination of Vicarious Liability by the Supreme Court

The Supreme Court presented a comprehensive assessment of the history of the law of vicarious liability which has developed as a doctrine from the late 17^th century in response to the expansion of commerce and industry. The principle behind it is that where an employer employed the wrongdoer, and the employee committed a wrongful act against the claimant within the area of the authority given to him, it was fairer that the employer should suffer for the wrongdoing than the person who was wronged.

There have been a number of cases which have extended this principle further including amongst others: cases on the abuse of children in educational establishments; an assault on a customer by a petrol station attendant; a manager punching a colleague at a Christmas party; and a police officer shooting a man in a bar. In some cases, the employers were held liable for the actions of its employees but in others they were not as the actions of the employees were not sufficiently connected to their employment. None of the employees in these cases would have been authorised to act in the ways that they did. Therefore, the basic question is, when are employers liable for the actions of rogue employees?

The Supreme Court paid close attention to the "close connection" tests outlined in the 2003 case of Dubai Aluminium v...