Various Claimants v Morrisons

Facts

Skelton was a senior internal auditor at Morrisons who had been disciplined and held a grudge against the company. As part of his duties he was given payroll data of a large number of employees to pass to external auditors. He copied the data onto a personal device and later, from home, posted it on a file-sharing website and sent it to newspapers, in order to harm Morrisons. Thousands of employees whose data had been disclosed sued Morrisons.

History

The High Court held Morrisons not directly liable but vicariously liable for Skelton's breach of the Data Protection Act 1998, breach of confidence and misuse of private information. The Court of Appeal dismissed Morrisons' appeal, and Morrisons appealed to the Supreme Court.

Issue

Whether the Data Protection Act 1998 excluded vicarious liability, and whether Skelton's disclosure was so closely connected with the work he was employed to do that it was in the course of his employment.

Held

Appeal allowed. The Act did not exclude vicarious liability, but Morrisons was not vicariously liable because Skelton, in disclosing the data, was pursuing his own personal purposes and not engaged in his employer's business.

Ratio

• Vicarious liability is not excluded by the Data Protection Act 1998 as a means of imposing liability on an employer for the employee's breach of the Act.
• An employer is liable for an employee's tort when it is so closely connected with acts the employee was authorised to do that it can fairly be regarded as done in the course of employment, and where the employee is pursuing a personal purpose, such as vengeance against the employer, and is not engaged in his employer's business, the employer is not liable.

The judgments

Key reasoning

• The test is not whether the employment gave the opportunity to commit the tort, nor whether there is a temporal or causal link, but whether the wrongdoing is within the field of activities assigned to the employee so that it can be regarded as done in the course of the employment.
• Skelton's disclosure took place at his home, on his own time and using his own equipment, and there was no connection with a task he was asked to perform at that time.
• His motive was to harm his employer, and the employer's lack of vicarious liability was reinforced by the fact that to hold Morrisons liable would make the employer an instrument of the wrongdoer's plan, although motive is not always determinative.

Where it fits in the module

For FHS Tort, Morrisons is a starred case on the course of employment. It tests how far an employer is answerable for deliberate wrongdoing by an employee and how the close connection test of Lister v Hesley Hall and Mohamud v Wm Morrison Supermarkets plc [2016] UKSC 11 should be read. Students should be able to explain how the personal motive of the employee fits into the test and whether the rationale for vicarious liability explains the outcome.

Criticisms

• Making the employee's motive a factor risks introducing a subjective element into a doctrine that is supposed to be about the relationship between the employer and the employee and the allocation of risk, and it is not clear how much weight it carries.
• The decision leaves the claimants, who had their data exposed because the employer entrusted it to the wrongdoer, without a remedy from the party best placed to insure against the risk.
• By confining Mohamud to cases where the employee is acting on the employer's business, the court may have narrowed the close connection test in a way that is difficult to reconcile with the broader reasoning in Lister.