Clyde & Co's UK employment team brings you CABLE, a bulletin keeping you up to date with recent legal developments

Data breach: employer vicariously liable for data breach by rogue employee

The Court of Appeal has found that supermarket chain Morrisons was vicariously liable for the actions of a rogue employee who, driven by a grudge against the company, took payroll data relating to 100,000 employees and published it online.

Mr Skelton (S), an internal auditor and employee of supermarket chain Morrisons (M) deliberately published the personal data of 100,000 employees on a file sharing website and then anonymously sent the data on a CD to 3 newspapers. S was subsequently convicted for criminal misuse of the payroll data and sentenced to 8 years in prison. As soon as M discovered the breach, it took action to take the website down and to protect the data and any financial loss which might result from the disclosures. Despite this, 5500 employees brought a claim against M for S's act of disclosing the data.

The Court of Appeal found that M was vicariously liable for S's wrongful acts. Vicarious liability is where an employer is liable for the wrongful actions of its employees where (1) the employee's actions fall within the "field of activities" entrusted to them and (2) there is a sufficient connection between those wrongs and the employee's employment such that it would be fair to hold the employer vicariously liable. In this case, S had been deliberately entrusted with the payroll data in his role as internal auditor and when he published it online, this was within the "field of activities" assigned to him.

Practical point

Unless and until this decision is reversed on appeal to the Supreme Court, businesses should insure against data breaches because even if you take all reasonable steps to secure the personal data you hold, you may still be liable for breaches caused by rogue employees.

WM Morrison supermarkets PLC v various Claimants

For a detailed update on this decision, see Court of Appeal confirms supermarket vicariously liable for data breach by rogue employee

Vicarious liability: Employer liable for injury caused to employee after an office party

The Court of Appeal decided that a serious assault by the company's managing director at spontaneous post-Christmas party drinks, which resulted in an employee suffering brain damage, was sufficiently connected to the managing director's job for the company to be vicariously liable for the employee's injury.

The company's managing director (MD) assaulted another employee at an unscheduled "drinking session" at a local hotel after a work Christmas party, when there was an argument about internal company politics. The employee suffered brain damage as a result.

The Court of Appeal said that the two key issues to consider are:

  • What was the nature of MD's job - was he acting within the field of the activities assigned to him as managing director?
  • Was there a sufficient connection between his position and his wrongful conduct to make it appropriate for the employer to be liable for reasons of social justice?

The Court concluded that MD's remit and authority were very wide. He was the directing mind and will of the company and had responsibility for all management decisions, including the maintenance of discipline and would have seen the maintenance of his managerial authority as a central part of his role. He had also chosen to wear his "metaphorical managing director's hat" at the drinks as he was lecturing his subordinates about his rights as managing director.

The Court said there was sufficient connection between his position as MD and his wrongful conduct as the drinks followed a work event organised by MD on behalf of the company and he also organised and paid for taxis to the hotel and continued to provide drinks which were paid for by the company.

Practical point

Vicarious liability can arise at informal work-related social events. Employers are more likely to be vicariously liable for the actions of a managing director and other senior managers at these events than more junior staff.

However, the Court emphasised that the facts of this case are unusual. Liability will not always arise when an altercation between colleagues about work leads to an assault, even when one colleague is significantly more senior than the other.

Bellman v Northampton Recruitment Limited

Victimisation claim: was the employee acting dishonestly?

Victimisation occurs when a person (A) subjects another person (B) to a detriment because either:

  • B has done a "protected act", i.e. made an allegation that A has breached discrimination legislation
  • A believes B has done/ may do a protected act

But giving false evidence or information or making a false allegation is not a protected act if this was given or made in bad faith.

Mr Saad (S) was training to be a consultant surgeon. He raised a grievance alleging he had suffered racial or religious discrimination. The Tribunal decided that the allegation was false, and that, although he subjectively believed the alleged racist comment had been made, that belief was not reasonable. It also concluded he had raised the grievance in order to deflect performance issues, and therefore found he had acted in bad faith.

The EAT allowed the appeal. Because the allegation was made honestly, the employee had not made it in bad faith. It confirmed that employees can claim victimisation even where the allegation of discrimination is made for an ulterior motive – provided they acted honestly. The EAT also said that if the employee has an ulterior motive, this could impact on the amount of compensation awarded.

Practical point

The key issue is whether the employee acted honestly in giving the information or making the allegation relied on as a protected act.

For employers to succeed in defeating a victimisation claim under discrimination legislation, they must establish that:

  • the evidence, information or allegation of discrimination the employee made was false, and
  • the employee gave that evidence, information or allegation dishonestly
The more obviously false an allegation is, the more likely it is that a tribunal will find it was not made honestly – but the onus will be on the employer to prove this.

Saad v Southampton University Hospital NHS Trust

The key employment changes in the Budget

IR35 reforms - The off-payroll working rules currently applying to the public sector will be extended to large and medium-sized businesses in the private sector from April 2020. IR35 aims to combat tax avoidance by workers supplying their services to clients via personal service companies (PSC). In 2017, the off-payroll working rules were introduced in the public sector. This resulted in the onus of determining whether IR35 applies being transferred from the PSC to the public authority client. Either the client or the agency who pays the PSC for the worker's services must then make payroll deductions of tax and National Insurance Contributions from the fees it pays to the PSC.

Termination payments - The introduction of employer Class 1A NICs on termination payments over £30,000 is delayed until April 2020. This change will increase the cost of large termination payments so employers will welcome the delay in implementing this new rule.

National Minimum Wage and National Living Wage - From April 2019 the national living wage will increase to £8.21 and the 21-24 year old rate to increase to £7.70, subject to Parliamentary approval.

Government consultation on mandatory ethnicity pay reporting

The Government has launched a consultation asking for views on taking forward its manifesto commitment that large employers should publish ethnicity pay data. The consultation closes on 11 January 2019.

The consultation paper does not indicate when ethnicity pay reporting is expected to come into force. The Government is considering implementing a trial or phased approach in which it works with some employers in the public and private sectors to test different approaches before mandatory reporting is introduced.

For a detailed update on this consultation, see Government proposals on mandatory ethnicity pay reporting

Proposals to help parents and carers in the workforce

The Government is considering proposals to help parents and carers in the workforce, including creating a duty on employers to consider whether a role may be done flexibly, and making this clear when advertising the role.

In addition, the Government is considering proposals for greater transparency on parental pay. It will consult on whether to require employers with at least 250 staff to publish on their website their parental leave and pay policies, so job applicants can make informed decisions. Currently job applicants have to ask for this information, which many are reluctant to do for fear of discrimination.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.