Further to our last article on the Morrisons vicarious liability case, the Supreme Court has now overturned the Court of Appeal's decision to find Morrisons vicariously liable for breaches of the Data Protection Act 1998 with respect to an employee leaking the payroll data of around 100,000 other employees online and to 3 newspapers.
Vicarious Liability: Background To The Morrisons Case
In 2014, Andrew Skelton, a senior internal auditor with Morrisons, posted the payroll data of almost 100,000 Morrisons employees online by uploading it to a file sharing website. He also sent anonymous links to 3 newspapers. This represented a breach of the Data Protection Act 1998, and Mr Skelton was later convicted of fraud, of securing unauthorised access to computer data, and of disclosing the personal data relating to the said employees, at Bradford Crown Court in July 2015. He was sentenced to 8 years in prison.
A group of 9263 of the 100,000 employees who had had their data leaked sued Morrisons in the High Court in the first ever class action relating to data leaks and vicarious liability, claiming compensation for upset and distress.
In November 2017, the High Court found in favour of the 9263 Claimant's, holding Morrisons vicariously liable for the data leak. That decision was then upheld by the Court of Appeal in October 2018. Morrisons then appealed that decision to the Supreme Court, who heard the appeal in November 2019.
The Supreme Court's Decision
On the 1st April 2020, the Supreme Court found in favour of Morrisons in a landmark ruling on the issue of vicarious liability, and overturned the decision of the Court of Appeal. The Supreme Court held that the Court of Appeal had "misunderstood the principles governing vicarious liability in a number of relevant respects." Lord Reed, on behalf of the Court, stated that the key question was "whether Skelton’s disclosure of the data was so closely connected with acts he was authorised to do that, for the purposes of the liability of his employer to third parties, his wrongful disclosure may fairly and properly be regarded as done by him while acting in the ordinary course of his employment, [and the answer is] no." The Court held that this was because the data leak did not fall within Skelton's "field of activities," it was not closely connected to his job, it was not an act that he had authority to undertake, and therefore Skelton could not be held to be acting in the course of his employment. Lord Reed concluded by stating that: "whether [Skelton] was acting on his employer’s business or for purely personal reasons was highly material. [He was] “not acting on his employer’s business, but in pursuit of his own private ends [and was] seeking vengeance for the disciplinary proceedings some months earlier.”
Vicarious Liability: The Implications
The ruling by the Court of Appeal on vicarious liability was always highly questionable, as it is hard to see what more that Morrisons could have done to prevent the data leak. The ruling by the Supreme Court, therefore, is both the right one and a welcome one. Nevertheless, it remains imperative for employers, in order to avoid adverse rulings in relation vicarious liability re data protection, that they do absolutely everything they can to ensure that their employees comply with data protection rules, and that there is clear internal guidance for employees in how to handle personal data.
