Vicarious liability – the Supreme Court brings employers some comfort

The Supreme Court has recently handed down two judgments on an employer’s vicarious liability for the actions of an employee in one case and a self-employed doctor in the other.

No vicarious liability for data breach

Employers will be relieved at the Supreme Court’s decision in Morrisons v various claimants that Morrisons was not vicariously liable for a major data breach by a rogue employee whose express intention was to cause the company financial and reputational harm. Mr Skelton, an internal auditor, had disclosed payroll details of nearly 100,000 employees on the internet. There was no financial loss, but over 5,000 employees had brought damages claims for distress. 

The Supreme Court clarified that, for vicarious liability to arise, the wrongful conduct had to be so closely connected to acts that the employee was authorised to do, it might be fairly and properly be regarded as done by the employee while acting in the ordinary course of their employment. In this case, the disclosure of data on the internet was not part of the employee’s functions or field of activities. The Court also confirmed that it was also not enough that the employee’s role gave them the opportunity to commit the wrongful act and the fact that there was a close temporal link and an unbroken chain of causation did not of itself satisfy the close connection test. Also, it considered that the employee’s motive was highly relevant particularly in a case such as this where he was pursuing a personal vendetta.  

Morrisons was helped by the fact that it was itself not in breach of any data protection obligations. This emphasises how important it is for employers to ensure they have robust procedures in place to ensure compliance particularly since GDPR came into effect otherwise they will be subject to significant fines and compensation. Going forwards, courts will look at what the data controller has done to prevent data security breaches and in this era of mandatory notification businesses will need to look carefully at the measures they take to mitigate against the risks including taking out insurance to protect themselves.  

No vicarious liability for sexual assault

The Supreme Court also held that the employer was not vicariously liable in Various claimants v Barclays Bank for the actions of a rogue doctor who sexually assaulted over 100 female job applicants sent for a pre-employment medical check. This Court found that the doctor was genuinely self-employed on his own account as the examinations took place in his home, he was not paid a retainer and had his own portfolio of clients of which Barclays was one. His relationship with Barclays was not akin to an employment relationship but that of independent contractor.

This is a harsh decision for the victims as they have no remedy as the doctor had died in 2009 and the estate had been distributed. However, it confirms beyond doubt that vicarious liability does not apply to the relationship with a genuinely self-employed person.