Introduction 

The Supreme Court has ruled that Morrisons was not vicariously liable for an unauthorised data breach intentionally committed by a disgruntled former employee.

Background

Andrew Skelton, an internal auditor at Morrisons, received a verbal warning for minor misconduct in July 2013. As a result, he held a grudge against the company. Several months later, in November 2013, Mr Skelton was asked to send internal payroll data to Morrisons' external auditors, as he had done on previous occasions. This time, as he did so, he also made and kept a copy of the data. The data contained personal information on employees, including names, dates of birth, national insurance numbers, bank account information, etc.

In January 2014, Mr Skelton uploaded a file containing personal data on 98,998 Morrisons' employees to a publicly accessible file-sharing website. He was at home when he made the disclosure, using a personal mobile phone and false email account.

In March 2014, Mr Skelton alerted three newspapers of the leak of personal data, posing as a concerned member of the public who had simply found it. The newspapers did not publish the data, but one of them did inform Morrisons, who quickly acted to have the data removed and informed the police. It also informed the employees and undertook measures to protect their identities. Mr Skelton was arrested a few days later and eventually sentenced to eight years in prison.

In the lower courts

The claimants in this case, a group of Morrisons employees whose personal data had been leaked, brought proceedings against Morrisons for breach of the Data Protection Act 1998, misuse of private information and breach of confidence – based on primary as well as vicarious liability.

The lower courts rejected the notion that Morrisons was under a primary obligation in respect of any of the alleged breaches but, nevertheless, found it vicariously liable for the acts of Mr Skelton. The Court of Appeal found that what happened after Morrisons provided Mr Skelton with the data was a seamless episode in the ordinary course of Mr Skelton's employment. It was considered immaterial that Mr Skelton's objective was to harm Morrisons. Even though Mr Skelton made the disclosure at home, using personal equipment, it was still within the field of activities assigned to him.

Decision of the Supreme Court

The Supreme Court overturned the lower courts' decisions. The crucial issue in determining vicarious liability was whether Mr Skelton made the information public within the ordinary course of his employment. In a unanimous decision, the Supreme Court held that he did not.

The Court considered whether Mr Skelton's conduct was so closely connected with what his employer authorised him to do that it may fairly and properly be regarded as done in the ordinary course of his employment (known as the "close connection" test). 

The Supreme Court said the key was the capacity with which an employee was acting when the events took place. It observed that the mere fact that Mr Skelton's employment gave him the opportunity to commit the wrongful act was not sufficient to warrant imposing vicarious liability.

Further, the Supreme Court said that a previous court's comment that "motive is irrelevant" should not be taken out of context. In this case, it was highly relevant whether Mr Skelton was acting for Morrisons' business or for purely personal reasons. The Court said a distinction should be drawn between cases where an employee was engaged in furthering his employer's business and cases where an employee is pursuing his own interests. Mr Skelton was guided purely by a sense of personal vengeance and acted with the specific intention of harming his employer. Accordingly, the imposition of vicarious liability was not warranted.

Comment

The Supreme Court's decision will surely allow employers to breathe a sigh of relief. The lower courts' decisions would have opened up the potential for broad liability for the acts of rogue employees. Provided businesses continue to comply with data protection requirements under the GDPR, they are unlikely to be liable for acts of employees which are firmly outside their control.