Potential scope of an employer’s liability for the actions of their employees when they are outside the usual duties of their employment reduced - Simon Morris elaborates below.

A recent decision of the Supreme Court has reduced the potential scope of an employer’s liability for the actions of their employees when they are outside the usual duties of their employment and provided some clarity on class actions for data breach.

Morrisons employed Andrew Skelton in their internal audit team. In November 2013 Mr Skelton had the responsibility to transmit Morrisons’ workforce’s payroll data to external auditors. Mr Skelton kept a copy of that payroll data and uploaded it to a publicly accessible file sharing website and sent it anonymously to three UK newspapers, although they did not publish the information. One of the newspapers informed Morrisons who took steps to remove the data that had been published online. Mr Skelton was prosecuted and imprisoned.

Around 9,000 affected employees brought a claim against Morrisons on the basis that they should be vicariously liable for Mr Skelton’ actions as his employer. The claims were brought based on the data protection act 1998, misuse of private information, and breach of confidence.

At the first instance hearing the Court gave judgment that Morrisons was not primarily liable for the various claims but that they were liable for Mr Skelton’s actions and found that he was acting in the course of his employment.

On appeal to the Supreme Court the decision was unanimously overturned and Morrisons’ escaped any liability for Mr Skelton’s actions.

This landmark judgment in favour of employers and data handlers will not completely remove the risk of liability for a wayward employee.

The relevant test as clarified by the Supreme Court is whether the employee is acting in his ‘‘field of activities” and whether it can be shown that is sufficient connection between the job and the infringing conduct.

In this particular case, Mr Skelton’s motivation was a personal vendetta against Morrisons following disciplinary proceedings. He had not been authorised by his employer to publish the data online.

The Supreme Court held that although there was a close link in time and an unbroken chain of causation between Mr Skelton being provided with the data and disclosing it on the internet, this does not satisfy the requirements of a close connection test.

The reality was that Mr Skelton’s actions were not linked to his field of activities but rather he was motivated to specifically harm his employer.

The overall effect of the Supreme Court decision is likely to restrict the scope of vicarious liability for employers as it has been applied in recent times. However, it remains to be seen whether interpretation of this authority may come to be limited to circumstances where wrongdoing is intended to harm the employer or principal.

It is also noteworthy that the Supreme Court rejected the submission that the Data Protection Act 2018 and General Data Protection Regulation exclude vicarious liability for either statutory or common law wrongs. As such, it remains open to classes of people affected by data breaches caused by their data handler’s employees to pursue a remedy against the data handler under the Data Protection Act 2018 and General Data Protection Regulation on a case by case basis.

This case had been the first class action by victims of a data breach of this type brought in the UK. This judgment will affect the way that data handlers now formulate their data management policies and procedures in relation to rogue employees although the judgment leaves to door open to possible liability for data breaches caused by an employee – ongoing the motives of the employee and the factual circumstances of the breach will need to be considered very carefully before initiating proceedings.

Other recent cases have permitted classes of claimants to seek damages for the distress caused by the publication of their personal data and this authority is unlikely to impact on the trend for cases of this type barring exceptional circumstances.