Employer not vicariously liable for the vengeful act of an employee

The Supreme Court has final say on long-running series of cases caused by an intentional data leak.

Cases concerning an employer's liability for the actions of their staff often cause concern, particularly where the law is seen to be 'extended' by the courts to hold an employer liable. In such cases the primary concern is whether the wrongful actions of an employee can be fairly and properly considered as being done in the ordinary course of employment. If so, the employer may be liable.

The problem is that the application of this reasoning is highly fact-specific, meaning that cases which sound very similar to one another can be decided quite differently.

In October 2018 we considered the Court of Appeal's decision in the Morrisons Supermarkets Plc v Various Claimants case. In its decision, the Court of Appeal held that there was sufficient connection between the job and actions of a Morrison's employee to make Morrisons liable for the employee's act of leaking personal data of Morrisons employees on to the internet. Morrisons appealed the decision and we now have a useful Supreme Court decision on this issue making clear that Morrisons was not liable for the employee's deliberate data breach.  

Case details: WM Morrison Supermarkets plc v Various Claimants

Mr Skelton, an employee of Morrisons, was tasked with providing personal employee information to an external auditor. He did this, but also secretly made a copy of the data which he later posted to a website. He then also sent copies of the data to newspapers, posing as a concerned member of the public. It appears Mr Skelton had been motivated to do this as an act of vengeance against his employer after he received a verbal warning for a minor disciplinary matter.

When Morrisons was made aware of the breach it acted to protect its employees' identities and information. Not long after, Mr Skelton was arrested and ultimately he received a prison sentence for his actions. Several thousand Morrisons employees whose data had been leaked sued Morrisons for damages on the basis that the supermarket was liable for the actions of Mr Skelton.

The High Court and Court of Appeal found in the employees' favour on the basis that Mr Skelton's actions were within the course of his employment. This in part had been decided on the basis that, in the view of the courts, there was a clear causal link between what he had been asked to do by his employer and the information being leaked. The courts also found that Mr Skelton's motivation to harm his employer was irrelevant, in part because of the decision of the Supreme Court in Mohamud v Wm Morrison Supermarkets plc  which suggested that the motivation of the employee was irrelevant.

The Supreme Court's decision

In its decision, the Supreme Court outlined that the lower courts had misapplied the tests for vicarious liability through a narrow interpretation of the Supreme Court's decision in the case of Mohamud. In particular, the Supreme Court was keen to draw attention to case law that had differentiated between employees who had acted in the course of their duties to their employer, thus making the employer liable, and cases where employees had been found to have gone off 'on a frolic of their own', where the employer was not liable.

One example was the case of Mohamud itself, where a petrol station attendant attacked a customer after ordering the customer not to return to the petrol station. In that case, the Supreme Court had found the employer liable because the assault was used to underline to the customer that they should not return to the petrol station. In short, the assault was directly related to the employee's duties and his place of work and the employer was liable for the assault.

As a result, in Mohamud the Court had determined that the employee's motivations were irrelevant because the vicarious liability test had already been met. Mistakenly, the lower courts had taken this to be a more general rule, which the Supreme Court found not to be the case.

The Supreme Court also referred to the case of Bellman v Northampton Recruitment Limited, a case in which the managing director of a company assaulted a subordinate at a work function after a disagreement arose about the MD's decision to recruit a particular employee. In this case the employer was found to be liable because the MD was making a show of his authority over colleagues, which he then underlined by carrying out the assault.

In contrast, the Supreme Court referred to a British Virgin Islands case in which a police officer left his post and injured a third party after firing his service revolver when he found his partner with another man. In this case, the officer's employer was not found liable for the injury caused because the officer had 'embarked … on a personal vendetta of his own'.

The Supreme Court noted that motivation was an important factor in determining whether an employee was acting to further his employer's business or to his own personal ends. It concluded that it was clear that when Mr Skelton leaked the personal data of employees he was acting on 'a frolic of his own', motivated by vengeance against his employer for having verbally disciplined him previously.

For this reason, Morrisons was not liable for Mr Skelton's actions.

Comment

The decision of the Supreme Court in this case will provide some relief to employers who were concerned by the decisions of the High Court and Court of Appeal.

Had the previous decisions stood, employers would have been left facing a much broader potential liability for employee actions than before. That was, as long as a third party could show that there was a causal link between harm or damage to them and the job the employee was employed to do, employers were at risk of being found liable for the harm or damage caused, no matter what the motive of the employee.

In this case, that causal link was provided by Morrisons asking Mr Skelton to provide the employee data to a third party auditor and then giving him access to that data, which he misused. The Supreme Court has identified that this alone is not enough to make an employer liable for the subsequent actions of the employee.

However, as always with vicarious liability cases, the warning that these cases are highly fact sensitive remains.