WM Morrison Supermarkets Plc v Various Claimants

Vicarious liability for an employee’s misuse of private information or breach of confidence is not excluded by the Data Protection Act 1998 unless Parliament has done so by necessary implication. The statutory scheme regulates the primary duties of the data controller but does not address an employer’s liability for an employee data controller’s wrongdoing. The ordinary close-connection test applies broadly: the employee’s field of activities is identified first, followed by consideration of the connection between that position and the wrongful conduct. The employee’s motive is irrelevant. Deliberate disclosure outside the workplace may still fall within the course of employment where it forms part of an unbroken sequence linked to the assigned task.

More than 5,000 current and former employees brought claims against Morrisons after Andrew Skelton, a former employee, copied payroll data while at work and later disclosed it on the internet. Langstaff J held that Morrisons was not primarily liable under the Data Protection Act 1998, for misuse of private information or for breach of confidence, but was vicariously liable for Skelton’s wrongdoing: [2017] EWHC 3113 (QB).

Morrisons appealed on the grounds that the statutory scheme excluded vicarious liability and the common-law and equitable causes of action, and that Skelton’s conduct was outside the course of employment. The central issues were statutory exclusivity and the application of the close-connection test to a malicious data disclosure made away from work.

Appeal dismissed. The Court of Appeal upheld the finding that Morrisons was vicariously liable for Skelton’s misuse of private information and breach of confidence.

1. Statutory exclusion. The relevant question was whether Parliament had intended, by necessary implication, to exclude the common-law remedy. The approach in R (Child Poverty Action Group) v Secretary of State for Work and Pensions [2010] UKSC 54 was applied. A statutory remedy is likely to exclude a common-law remedy only where the schemes cover the same ground and are substantially incompatible. The Data Protection Act 1998 imposed primary duties on the data controller, but said nothing about an employer who was not the data controller. It therefore did not exclude vicarious liability for an employee’s common-law or equitable wrongs.
2. Close connection. Following Mohamud v Wm Morrison Supermarkets plc [2016] UKSC 11, the court asked first what field of activities Morrisons had entrusted to Skelton and secondly whether there was a sufficient connection between that position and his wrongful conduct.
3. Application. Skelton had been deliberately entrusted with receiving, storing and disclosing payroll data to KPMG. His unauthorised disclosure was closely related to that assigned task. The fact that the disclosure occurred at home, on a Sunday, using personal equipment and after a period of delay was not decisive. The copying, concealment and later publication formed a seamless and continuous sequence. Credit Lyonnais Bank Nederland NV v Export Credits Guarantee Department [2000] 1 AC 486 and Warren v Henlys [1948] 2 All ER 935 were distinguishable.
4. Motive. The employee’s motive was irrelevant. There was no exception where the employee intended to harm the employer. Deliberate wrongdoing may attract vicarious liability where the close-connection test is satisfied. The availability of insurance was a legitimate answer to arguments about potentially catastrophic liability, although it was not itself a basis for imposing liability.

1. Court of Appeal (Civil Division). The appeal was dismissed, upholding Morrisons’ vicarious liability.
2. High Court of Justice, Queen’s Bench Division. Langstaff J held Morrisons vicariously liable for the wrongful disclosure of employee data: [2017] EWHC 3113 (QB).