The Supreme Court has overturned the Court of Appeal's finding that Morrisons was vicariously liable for the deliberate and criminal disclosure by a rogue employee of personal data belonging to co-workers in WM Morrison Supermarkets plc (Appellant) v Various Claimants (Respondents) [2020] UKSC 12.
The 21 page judgment is a very welcome decision for companies and organisations of all sizes. The Supreme Court has confirmed that employers will not be vicariously liable for the rogue actions of employees acting outside their ordinary course of employment. This decision will clearly come as a huge relief to employers who will no longer have to ensure that they have insurance cover in place to insure against potentially huge losses caused by such disgruntled employees.
The facts
Mr Skelton was employed by Morrisons as a senior IT internal auditor. In 2013 he was disciplined for a minor misconduct but later that year, as part of his role at Morrisons, he was asked to send payroll data from Morrisons to KPMG. In that regard he was provided with an encrypted USB stick which contained the information. However, as well as forwarding the information to KPMG, he downloaded it onto his work computer. Just before Morisons' annual financial reports were announced a file containing the personal details of almost 100,000 Morrisons' employees was posted on a file sharing website by Mr Skelton. Mr Skelton also contacted a number of national newspapers alerting them to the personal data leak.
Following this disclosure, Mr Skelton was arrested and later imprisoned for various offences including fraud, an offence under the Computer Misuse Act 1990 and a criminal breach of section 55 of the Data Protection Act 1998.
However, the co-workers whose data had been disclosed made a group civil claim against Morrisons for compensation arguing that Morrisons had both primary liability for its own acts and omissions and vicarious liability for the actions of Mr Skelton. The High Court found that whilst Morrisons had no primary liability but it was vicariously liable for Mr Skelton's actions. The Court of Appeal upheld this finding.
The Court of Appeals judgment allowed the possibility of claims for damages from all Morrisons' workforce, approximately 100,000 workers which would have had very significant financial implications. Given the extremely serious implications Morrisons appealed to the Supreme Court and a two hearing was held in November 2019.
The decision
In a judgment dated 1 April 2020, the Supreme Court has overturned the Court of Appeal and dismissed the employees' claims against Morrisons. The Supreme Court found that both the trial judge and the Court of Appeal had misunderstood the principles governing vicarious liability.
The Supreme Court has overturned the Court of Appeal's decision that Morrisons was vicariously liable for Mr Skelton's actions. Whilst Mr Skelton was authorised by Morrisons to transmit payroll data to Morrisons' auditors, his wrongful disclosure of the data was not so closely connected with that task that it could be properly regarded as made by Mr Skelton while acting in the ordinary course of his employment. The fact that his employment gave him the opportunity to commit the wrongful act was not sufficient to lead to vicarious liability on the part of his employer. The Supreme Court reasoned that an employer will not normally be vicariously liable in situations where the employee was not engaged in furthering his employer's business, but rather was pursuing a personal vendetta.
Implications
Following this welcome decision, if an employer has met its obligations under the data protection legislation, there will be no liability where an employee is acting outside their ordinary course of employment pursuing "a personal vendetta of his own" or "an act entirely of personal vengeance".
