WM Morrison Supermarkets plc (Appellant) v Various Claimants (Respondents)[2020] UKSC 12On appeal from [ 2018] EWCA Civ 2339<\/p>\n
This appeal concerns the circumstances in which an employer is vicariously liable for wrongs committed by its employees, and also whether vicarious liability may arise for breaches by an employee of duties imposed by the Data Protection Act 1998 (\u201cDPA\u201d). The appellant operates a chain of supermarkets and employed Andrew Skelton on its internal audit team. In July 2013, Skelton received a verbal warning after disciplinary proceedings for minor misconduct and bore a grievance against the appellant thereafter. In November 2013, Skelton was tasked with transmitting payroll data for the appellant\u2019s entire workforce to its external auditors, as he had done the previous year. Skelton did so, but also made and kept a personal copy of the data. In early 2014, he used this to upload a file containing the data to a publicly accessible filesharing website. Skelton later also sent the file anonymously to three UK newspapers, purporting to be a concerned member of the public who had found it online. The newspapers did not publish the information.<\/p>\n
Instead, one alerted the appellant, which took immediate steps to have the data removed from the internet and to protect its employees, including by alerting police. Skelton was soon arrested and has since been prosecuted and imprisoned. The respondents, some of the affected employees, brought proceedings against the appellant personally and on the basis of its vicarious liability for Skelton\u2019s acts. Their claims were for breach of statutory duty under the DPA, misuse of private information, and breach of confidence. At trial, the judge concluded that the appellant bore no primary responsibility but was vicariously liable on each basis claimed. The judge rejected the appellant\u2019s argument that vicarious liability was inapplicable given the DPA\u2019s content and its foundation in an EU Directive. The judge also held that Skelton had acted in the course of his employment, on the basis of Lord Toulson\u2019s judgment in Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11 (\u201cM ohamud\u201d). The appellant\u2019s subsequent appeal to the Court of Appeal was dismissed.<\/p>\n
The Supreme Court unanimously allows the appeal. Lord Reed gives the only judgment, with which Lady Hale, Lord Kerr, Lord Hodge and Lord Lloyd-Jones agree.<\/p>\n
The primary issue before the Court is whether the appellant is vicariously liable for Skelton\u2019s conduct. The starting point is Lord Toulson\u2019s judgment in Mohamud, which was not intended to change the law of vicarious liability but rather to follow existing precedents [16-21]. One such authority was the House of Lords\u2019 decision in Dubai Aluminium Co Ltd v Salaam [2003] 2 AC 366 (\u201cDubai Aluminium\u201d), where Lord Nicholls explained the existing \u201cclose connection\u201d test of whether the wrongful conduct was so closely connected with acts the employee was authorised to do that for the purposes of the liability of\u00a0employer to third parties, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment. The test had to be applied having regard to the circumstances of the case and previous court decisions, following Dubai Aluminium [22-23]. Having explained the \u201cclose connection\u201d test, Lord Toulson summarised the law in \u201cthe simplest terms\u201d. The first question was what functions or \u201cfield of activities\u201d the employer had entrusted to the employee. Next, \u201cthe court must decide whether there was sufficient connection between the position in which he was employed and his wrongful conduct to make it right for the employer to be held liable under the principle of social justice which goes back to Holt CJ\u201d. This had been more fully explained in Dubai Aluminium by Lord Nicholls as set out above [25]. Lord Toulson was not suggesting any departure from Lord Nicholls\u2019 approach [26]. Further, read in context, Lord Toulson\u2019s comments that on the facts of Mohamud there was an \u201cunbroken sequence of events\u201d and a \u201cseamless episode\u201d referred to the capacity in which the employee had been purporting to act when the wrongful conduct took place, namely \u201cabout his employer\u2019s business\u201d [28].<\/p>\n
Lord Toulson\u2019s comment, in relation to the facts of Mohamud, that \u201cmotive is irrelevant\u201d should not be taken out of context: whether the employee was acting on his employer\u2019s business or for personal reasons was important, but, on the facts of Mohamud, the reason why he had committed the tort could not make a material difference to the outcome[29-30]. The Court concludes that the judge and the Court of Appeal misunderstood the principles governing vicarious liability in a number of respects. First, the online disclosure of the data was not part of Skelton\u2019s \u201cfield of activities\u201d, as it was not an act which he was authorised to do. Secondly, the satisfaction of the factors referred to by Lord Phillips in Various Claimants v Catholic Child Welfare Society [2012] UKSC 56 was not to the point: those factors were relevant to whether, where the wrongdoer was not an employee,the relationship between wrongdoer and defendant was sufficiently akin to employment for vicarious liability to subsist. They were not concerned with whether employees\u2019 wrongdoing was so closely connected with their employment that vicarious liability ought to be imposed. Thirdly, a temporal or causal connection alone does not satisfy the close connection test. Finally, it was highly material whether Skelton was acting on his employer\u2019s business or for purely personal reasons [31].<\/p>\n
Considering the question afresh, no vicarious liability arises in the present case. Skelton was authorised to transmit the payroll data to the auditors. His wrongful disclosure of the data was not so closely connected with that task that it can fairly and properly be regarded as made by Skelton while acting in the ordinary course of his employment.<\/p><\/blockquote>\n
On long-established principles, the fact that his employment gave him the opportunity to commit the wrongful act is not sufficient to warrant the imposition of vicarious liability. An employer is not normally vicariously liable where the employee was not engaged in furthering his employer\u2019s business, but rather was pursuing a personal vendetta. The \u201cclose connection\u201d test elucidated by Lord Nicholls in Dubai Aluminium, in light of the cases that have applied it and on the particular facts of the present appeal, is not satisfied[32-47]. The second major issue before the Court is whether the DPA excludes imposition of vicarious liability for either statutory or common law wrongs. It is not strictly necessary to consider this in light of the above conclusion, but as full argument was heard, it is desirable that the Court expresses a view [48]. Ultimately the Court finds the appellant\u2019s argument that liability is excluded unpersuasive. Imposingstatutory liability on a data controller like Skelton is not inconsistent with the co-existence of vicarious liability at common law, whether for breach of the DPA or for a common law or equitable wrong, as the DPA says nothing about a data controller\u2019s employer. It is irrelevant that a data controller\u2019s statutory liability under the DPA is based on a lack of reasonable care, while vicarious liability for an employee\u2019s conduct requires no proof of fault. The same contrast exists at common law between, for example, an employee\u2019s liability in negligence and an employer\u2019s vicarious liability. It makes no difference that an employee\u2019s liability may arise under statute instead [54-55]. The appeal is therefore allowed [56].<\/p>\n