Various Claimants v WM Morrisons Supermarket Plc (Rev 1)

An employer is not directly liable under the Data Protection Act 1998, for misuse of private information or for breach of confidence where an employee, acting without authority and for criminal purposes, discloses personal data. The employer may nevertheless be vicariously liable for the employee’s wrongs.

The seventh data protection principle imposes a qualified obligation to take appropriate technical and organisational measures. The assessment requires a fact-sensitive balance between the likely harm, the nature of the data, technological development and the cost of protective measures. Vicarious liability is not excluded merely because the Act imposes duties on data controllers or because the employee acts for his own purposes. The decisive question is whether there is a sufficient connection between the employee’s position and the wrongful conduct.

5,518 employees brought claims against Morrisons after Andrew Skelton, a senior IT auditor, criminally disclosed payroll and personal information concerning approximately 100,000 employees. The claims alleged breach of statutory duty under section 4(4) of the Data Protection Act 1998, misuse of private information and breach of confidence.

The claimants alleged both primary liability and vicarious liability. The trial concerned liability only. The central issues were whether Morrisons had itself breached the statutory or common-law duties, whether the seventh data protection principle had been breached by inadequate controls, whether the statutory scheme excluded vicarious liability, and whether Skelton’s conduct was sufficiently closely connected with his employment.

1. Primary liability. Morrisons was not directly liable under the Data Protection Act 1998 for breaches of the first, second, third or fifth data protection principles. When Skelton copied and disclosed the data for his own criminal purposes, he was acting as the relevant data controller in respect of that processing. Morrisons remained the controller of the information held on its own systems, but had not itself carried out the unlawful processing. The same conclusion applied to misuse of private information and breach of confidence.

2. Seventh data protection principle. The obligation to take appropriate security measures was qualified, not absolute. The appropriate standard depended on the state of technological development, the cost of the measures, the nature of the data and the harm which might result. The court applied a balancing approach analogous to the common-law assessment of reasonable care. Morrisons’ systems were generally adequate. The failure to operate an organised system for checking deletion of data stored temporarily outside the PeopleSoft system amounted to a breach, but it neither caused nor contributed to the disclosure.

3. Vicarious liability under the statutory scheme. The Data Protection Act 1998 did not expressly or impliedly exclude vicarious liability. The fact that the employee’s statutory duties arose from his status as a data controller did not prevent his employer being vicariously liable for his tortious acts committed in the course of employment. The Act also did not occupy the field so as to exclude the common-law actions, which were complementary to the statutory protection.

4. Close connection. Applying Mohamud v William Morrison Supermarkets plc [2016] UKSC 11, the court considered the employee’s field of activities and whether there was sufficient connection between his position and the wrongdoing. Skelton had been deliberately entrusted with confidential payroll data for receipt, storage and onward disclosure. His copying and later disclosure formed an unbroken sequence of events. The fact that the disclosure occurred at home, on a Sunday and with personal equipment, and was motivated by a grudge, did not sever the connection.

5. The claimants therefore established secondary liability for misuse of private information, breach of confidence and breach of the statutory duties arising from Skelton’s conduct. Leave to appeal the vicarious-liability conclusion was granted.

This was a first-instance decision. The court granted Morrisons leave to appeal its conclusion on vicarious liability.