The Supreme Court held that Morrisons was not vicariously liable for a senior auditor who copied staff payroll data and published it online in order to harm the company. The courts below had treated a close link in time and causation, and the supposed irrelevance of motive, as enough to make the employer liable. Lord Reed, with whom the other Justices agreed, held that those readings of Mohamud were wrong: a disclosure made as a personal vendetta was not done in the ordinary course of employment.
The payroll data and the disclosure
Andrew Skelton, a senior internal auditor, was authorised to send payroll data to Morrisons’ external auditor. The data covered the supermarket’s workforce.
Law Teacher writing support
Writing a law essay?
We choose a writer who is an expert in your area of law and qualified to at least the academic level you select. Most of our writers hold a master’s degree or PhD, have teaching experience, or both.
Send us your question and, if you wish, any marking criteria. We’ll write an essay to your instructions.
Skelton carried out the authorised task but also secretly kept a copy. He had a grievance against his employer after a disciplinary warning.
Acting from home, he published the copied data online and later sent it to newspapers. A newspaper alerted Morrisons, which sought to remove the material and protect affected employees. Skelton was subsequently convicted.
The claims and the decisions below
9,263 employees and former employees sued. They alleged that Morrisons itself had breached the statutory duty in section 4(4) of the Data Protection Act 1998, misused private information and breached confidence. They also argued that Morrisons was vicariously liable for Skelton’s conduct under the same three heads. The claims were for damages for distress, anxiety, upset and damage. The High Court made a group litigation order, selected ten lead claimants and stayed the remaining claims. Liability was tried separately from the assessment of damages, which had not yet taken place.
Langstaff J rejected any primary liability on Morrisons’ part, but held Morrisons vicariously liable for Skelton’s breach of statutory duty, misuse of private information and breach of confidence. He held that the Data Protection Act did not prevent vicarious liability, whether for Skelton’s breach of the Act or for the other two wrongs. On the facts, he treated events after Morrisons provided the data as a seamless and continuous sequence and an unbroken chain. Skelton’s task was, in essence, to receive, store and disclose the data to a third party. Disclosure to people other than KPMG was unauthorised, but closely related to that task. The judge also relied on five factors listed by Lord Phillips in Various Claimants v Catholic Child Welfare Society, and on Morrisons having taken the risk of trusting Skelton with the information.
The Court of Appeal (Sir Terence Etherton MR, Bean and Flaux LJJ) dismissed Morrisons’ appeal. It recorded that there was no pleaded claim of vicarious liability for Skelton’s breach of the Act, and it was conceded that the claims for misuse of private information and breach of confidence were not excluded by the Act. It held that sending the data to third parties was within the field of activities assigned to Skelton, and that his motive to harm his employer was irrelevant.
What the close connection test requires
The agreed issues in the Supreme Court were whether Morrisons was vicariously liable for Skelton’s conduct and, if so, whether the 1998 Act excluded vicarious liability for his breach of the Act or for misuse of private information and breach of confidence. Lord Reed, with whom Lady Hale, Lord Kerr, Lord Hodge and Lord Lloyd-Jones agreed, held that the courts below had misunderstood Mohamud v WM Morrison Supermarkets plc.
Mohamud concerned a petrol-station attendant who abused a motorist, followed him onto the forecourt and assaulted him. The Supreme Court rejected an argument that the test should be broadened, but held the employer liable on the existing law. Lord Toulson’s references to an unbroken sequence, a seamless episode, the irrelevance of motive and a principle of social justice associated with Holt CJ were a brief summary of established principle. Taken out of context, they had been treated as new rules. That would have been a major change in the law, which Lord Toulson had not intended.
The general principle, stated by Lord Nicholls in Dubai Aluminium Co Ltd v Salaam and endorsed in Mohamud, is that the wrongful conduct must be so closely connected with acts the employee was authorised to do that, for the purpose of the employer’s liability to third parties, it may fairly and properly be regarded as done while the employee was acting in the ordinary course of employment. Those words are not an invitation to decide by a personal sense of justice. The court must identify, from previous decisions, what points towards or against liability.
Read in context, the unbroken sequence and seamless episode in Mohamud described the capacity in which the attendant was acting, not a mere chain of time or causation. He was purporting to act about his employer’s business, and the episode was not something personal. Once that was established, the reason he became violent did not matter. Whether an employee is on his employer’s business or pursuing private ends remains highly material.
Four errors followed. Publishing the data on the internet was not an act Skelton was authorised to do, so it was not within his field of activities in Lord Toulson’s sense. Lord Phillips’ five factors concerned whether a relationship with someone who is not an employee is akin to employment, not whether this wrong was closely connected with employment. A temporal or causal chain does not itself satisfy the close connection test. And Skelton’s reason for acting was highly material.
Why Skelton’s disclosure was outside his employment
The question therefore had to be considered afresh. Skelton was authorised to collate the data and transmit it to KPMG, which he did. The connection with the later disclosure was that he could not have made it unless he had been given that task and had copied the data on 18 November. The mere fact that employment gave him the opportunity was not enough. Nor was it enough that disclosure was the same kind of act as the task. As Lord Wilberforce explained in Kooragang Investments Pty Ltd v Richardson & Wrench Ltd, an employee may so clearly depart from the scope of his employment that the employer is not liable, even while performing acts of the class he was authorised to do.
The Court distinguished a misuse of authority in the course of the employer’s business from using an opportunity provided by work to pursue a private purpose. The fact that the employee intended to harm his employer was relevant to that distinction.
Skelton was not furthering Morrisons’ business. He was pursuing a personal vendetta and seeking vengeance for the disciplinary proceedings. His disclosure was not so closely connected with the acts he was authorised to do that it could fairly and properly be regarded as done in the ordinary course of his employment.
The Data Protection Act
That conclusion made the Act unnecessary to the result. Because the point had been fully argued, the court expressed its view. Morrisons abandoned a written argument based on EU harmonisation, and the court did not need to consider the Directive. The remaining argument was domestic. In Majrowski v Guy’s and St Thomas’s NHS Trust, Lord Nicholls said that vicarious liability applies to a breach of statutory duty sounding in damages unless the statute expressly or impliedly indicates otherwise.
Morrisons relied on section 13, which entitles an individual who suffers damage or distress by reason of a data controller’s contravention to compensation from that controller, and provides a defence that the controller took such care as was reasonably required. The seventh data protection principle also requires a controller to take reasonable steps to ensure the reliability of employees with access to personal data. It was common ground that Morrisons had performed its duties as a data controller, and that Skelton was himself a data controller of the data he copied and disclosed. Morrisons said that this scheme was inconsistent with strict vicarious liability for his breach of the Act or of duties at common law or in equity.
Lord Reed rejected that argument. A statutory liability on a data controller is not inconsistent with common law vicarious liability on his employer. The Act is silent about the employer, so the regimes do not conflict. It is not anomalous that the employee’s liability depends on a lack of reasonable care while vicarious liability does not depend on fault: the same contrast often exists where an employee is negligent at common law. The Act therefore neither expressly nor impliedly excludes vicarious liability for breach of the obligations it imposes, or of obligations at common law or in equity, where an employee data controller commits the breach in the course of employment. That condition was not satisfied here.
Verdict: The Supreme Court unanimously allowed Morrisons’ appeal. The employee acted in pursuit of a personal vendetta, outside the ordinary course of his employment. The Court also explained that the Data Protection Act 1998 did not itself exclude vicarious liability where the usual conditions were met.
Source: WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12
