Businesses in the British Isles are likely to welcome the landmark decision of the UK Supreme Court on 1 April 20201 that WM Morrison Supermarkets was not vicariously liable for the damage caused to members of its staff as a result of the misappropriation of their personal information by a colleague.
We have been following this case with interest in recent years as it has moved through the UK court system. Though not binding in Jersey or Guernsey, the Supreme Court's decision is likely to be persuasive to Channel Island courts presiding over proceedings that concern vicarious liability principles in the employment and data law context.
A WM Morrison Supermarkets employee, Andrew Skelton, who was employed in an internal audit role, downloaded a copy of the personal details of 98,998 co-workers including their salaries and bank details. In early 2014, Mr Skelton published that information on a public filesharing website and he sent the file to three UK newspapers. He was motivated by hostility to his employer after receiving a misconduct warning in 2013. Mr Skelton was sentenced to 8 years imprisonment for that criminal offence.
9,263 of the affected staff (current and former) brought a group civil action in the High Court against WM Morrison Supermarkets stating that it should compensate them on the basis that it was 'vicariously liable' for Mr Skelton's wrongdoing. They succeeded and the supermarket appealed.
In 2018, the Court of Appeal found that Mr Skelton had acted in the course of his employment and that his actions were sufficiently closely connected to his job that the employer was liable. The dismissal of the supermarket's appeal was of great concern to many in the business community. As was noted in the High Court and the Court of Appeal, there was little that the employer could have done to avoid the breach and it had no reason to believe that Mr Skelton was not fit to handle the information that he leaked. (It was also reported that the supermarket spent £2.26m in dealing with the immediate aftermath of the disclosure.) Facing significant compensation costs, WM Morrison Supermarkets appealed to the Supreme Court.
This month, the Supreme Court overturned the decision of the Court of Appeal, finding that the employer was not vicariously liable. It was considered highly material that Mr Skelton was not engaged in furthering WM Morrison Supermarkets' business when he committed the act in question; he was pursuing a personal vendetta. This decision will no doubt be met with relief by many employers.
The Supreme Court clarified that employers could only be held liable for the actions of their employees if the actions were "closely connected" with their duties at work. The online disclosure of the data was not part of Mr Skelton's "field of activities", as it was not an act which he was authorised to do as part of his job. He was authorised to send the payroll data to the auditors. His wrongful disclosure of the data was not so closely connected with that task that it can fairly and properly be regarded as made while acting in the ordinary course of his employment. While Mr Skelton's employment gave him the opportunity to commit the wrongful act, that is not sufficient to warrant the imposition of vicarious liability on the employer.
A short press summary about the decision can be found on the Supreme Court website here.
Footnote
1 WM Morrison Supermarkets plc (Appellant) v
Various Claimants (Respondents)
[2020] UKSC 12
Originally Published 17 April, 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.