Another skirmish on the boundaries of vicarious liability: data protection this time

7 April 2020 by Rosalind English

WM Morrison Supermarkets plc (Appellant) v Various Claimants (Respondents) [2020] UKSC 12 On appeal from: [2018] EWCA Civ 2339 – read judgment

The following summary is based on the Supreme Court’s press report.

This appeal concerned the circumstances in which an employer can be held to be vicariously liable for wrongs committed by its employees, and also whether vicarious liability may arise for breaches by an employee of duties imposed by the Data Protection Act 1998 (“DPA”).

The appellant operates a chain of supermarkets and employed Andrew Skelton on its internal audit team. In July 2013, Skelton received a verbal warning after disciplinary proceedings for minor misconduct and bore a grievance against the appellant thereafter. In November 2013, Skelton was tasked with transmitting payroll data for the appellant’s entire workforce to its external auditors, as he had done the previous year. Skelton did so, but also made and kept a personal copy of the data. In early 2014, he used this to upload a file containing the data to a publicly accessible filesharing website. Skelton later also sent the file anonymously to three UK newspapers, purporting to be a concerned member of the public who had found it online. The newspapers did not publish the information. Instead, one alerted the appellant, which took immediate steps to have the data removed from the internet and to protect its employees, including by alerting police. Skelton was soon arrested and has since been prosecuted and imprisoned.

The respondents, some of the affected employees, brought proceedings against the appellant personally and on the basis of its vicarious liability for Skelton’s acts. Their claims were for breach of statutory duty under the DPA, misuse of private information, and breach of confidence. At trial, the judge concluded that the appellant bore no primary responsibility but was vicariously liable on each basis claimed. The judge rejected the appellant’s argument that vicarious liability was inapplicable given the DPA’s content and its foundation in an EU Directive. The judge also held that Skelton had acted in the course of his employment, on the basis of Lord Toulson’s judgment in Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11 (“Mohamud”). The appellant’s subsequent appeal to the Court of Appeal was dismissed.

Judgment

The Supreme Court unanimously allowed the appeal. Lord Reed gave the only judgment, with which Lady Hale, Lord Kerr, Lord Hodge and Lord Lloyd-Jones agreed.

Reasoning behind the judgment

The primary issue before the Court is whether the appellant was vicariously liable for Skelton’s conduct. The starting point was Lord Toulson’s judgment in Mohamud, which was not intended to change the law of vicarious liability but rather to follow existing precedents [16-21]. One such authority was the House of Lords’ decision in Dubai Aluminium Co Ltd v Salaam [2003] 2 AC 366 (“Dubai Aluminium”), where Lord Nicholls explained the existing “close connection” test of whether the wrongful conduct was so closely connected with acts the employee was authorised to do that for the purposes of the liability of the employer to third parties, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment. The test had to be applied having regard to the circumstances of the case and previous court decisions, following Dubai Aluminium [22-23].

Having explained the “close connection” test, Lord Toulson summarised the law in “the simplest terms”. The first question was what functions or “field of activities” the employer had entrusted to the employee. Next,

the court must decide whether there was sufficient connection between the position in which he was employed and his wrongful conduct to make it right for the employer to be held liable under the principle of social justice which goes back to Holt CJ.

This had been more fully explained in Dubai Aluminium by Lord Nicholls as set out above [25]. Lord Toulson was not suggesting any departure from Lord Nicholls’ approach [26]. Further, read in context, Lord Toulson’s comments that on the facts of Mohamud there was an “unbroken sequence of events” and a “seamless episode” referred to the capacity in which the employee had been purporting to act when the wrongful conduct took place, namely “about his employer’s business” [28]. Lord Toulson’s comment, in relation to the facts of Mohamud, that “motive is irrelevant” should not be taken out of context: whether the employee was acting on his employer’s business or for personal reasons was important, but, on the facts of Mohamud, the reason why he had committed the tort could not make a material difference to the outcome [29-30].

The Court concluded that the judge and the Court of Appeal had misunderstood the principles governing vicarious liability in a number of respects. First, the online disclosure of the data was not part of Skelton’s “field of activities”, as it was not an act which he was authorised to do. Secondly, the satisfaction of the factors referred to by Lord Phillips in Various Claimants v Catholic Child Welfare Society [2012] UKSC 56 was not to the point: those factors were relevant to whether, where the wrongdoer was not an employee, the relationship between wrongdoer and defendant was sufficiently akin to employment for vicarious liability to subsist. They were not concerned with whether employees’ wrongdoing was so closely connected with their employment that vicarious liability ought to be imposed. Thirdly, a temporal or causal connection alone does not satisfy the close connection test. Finally, it was highly material whether Skelton was acting on his employer’s business or for purely personal reasons [31].

Considering the question afresh, no vicarious liability arose in the present case. Skelton was authorised to transmit the payroll data to the auditors. His wrongful disclosure of the data was not so closely connected with that task that it could fairly and properly be regarded as made by Skelton while acting in the ordinary course of his employment. On long-established principles, the fact that his employment gave him the opportunity to commit the wrongful act was not sufficient to warrant the imposition of vicarious liability. An employer is not normally vicariously liable where the employee was not engaged in furthering his employer’s business, but rather was pursuing a personal vendetta. The “close connection” test elucidated by Lord Nicholls in Dubai Aluminium, in light of the cases that have applied it and on the particular facts of the present appeal, was not satisfied [32-47].

The second major issue before the Court was whether the DPA excludes imposition of vicarious liability for either statutory or common law wrongs. It was not strictly necessary to consider this in light of the above conclusion, but as full argument was heard, it was desirable that the Court expresses a view [48]. Ultimately the Court found the appellant’s argument that liability was excluded unpersuasive. Imposing statutory liability on a data controller like Skelton was not inconsistent with the co-existence of vicarious liability at common law, whether for breach of the DPA or for a common law or equitable wrong, as the DPA says nothing about a data controller’s employer. It is irrelevant that a data controller’s statutory liability under the DPA was based on a lack of reasonable care, while vicarious liability for an employee’s conduct requires no proof of fault. The same contrast exists at common law between, for example, an employee’s liability in negligence and an employer’s vicarious liability. It makes no difference that an employee’s liability may arise under statute instead [54-55]. The appeal was therefore allowed [56].

Comment

Although this case concerned a different aspect of vicarious liability to that at the centre of the Barclays case (see that judgment here and Robert Kellar QC’s post on it here), it is interesting that the Supreme Court found that vicarious liability did not apply in respect of the independent contractor in Barclays, nor did it apply to Morrisons because their employee was on a frolic of his own. It is Robert Kellar’s view that vicarious liability should apply irrespective of the contractual status of the tortfeasor particularly in cases of sexual abuse; in other words that the gravity of the activity overrides distinctions between types of workers. The history of the doctrine of vicarious liability shows that whether a person is classified as an employee for the purposes of employment legislation (such as the Employment Rights Act) or tax purposes involves very different policy considerations to those behind vicarious liability. Clearly what Kellar calls the “boundary dispute” between employees, workers and independent contractors has caused a great deal of litigation outside the arena of vicarious liability, and we have recently seen the government struggling with this bright line in formulating first the Employee Retention Scheme and then the self-employment scheme to compensate workers for being laid off during the Covid-19 lockdown.

Should the gravity of the behaviour of the employee/worker/independent contractor be dispositive of vicarious liability rather than their status? The trial judge in this case concluded that Morrisons had to be liable otherwise the object of Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data would be defeated. He also rejected Morrisons’ argument that Skelton’s wrongful conduct was not committed in the course of his employment, holding that Morrisons had provided him with the data in order for him to carry out the task assigned to him, and that what had happened thereafter was “a seamless and continuous sequence of events … an unbroken chain” (para 184).  Skelton had been tasked with disclosing data to third parties, and the fact that he made this disclosure to other third parties in the course of a private vendetta did not break this chain. The Court of Appeal agreed that while Skelton’s motive in committing the wrongdoing was to harm his employer, Lord Toulson had said in Mohamud that motive was irrelevant to the imposition of vicarious liability on the employer. But now the Supreme Court has overturned that decision, we’re back with a case to case scrutiny of the particular motive and behaviour of the employee.

Robert Kellar and Isabel McArdle will be discussing these important decisions and the ones leading up to them (Cox, Armes, and Mohamud) on Law Pod UK, in an episode I will flag up as soon as it is ready to be posted. As Robert reflects in the interview, whether it’s a supermarket or a bank that is the subject of the litigation, the reach of the doctrine of vicarious liability is important for the NHS which is increasingly reliant upon private bodies to provide healthcare. So, in Robert’s words, “who is the correct defendant when things go wrong”? Are claimants entitled just to point their finger at the party with the deepest pocket, without any underpinning principles of social or moral justice?

Watch this space.