Supreme Court Judgment in WM. Morrisons Supermarkets PLC v Various Claimants [2020]

By Jasmine Cracknell

Last month, the Supreme Court handed down a decision in the long-awaited Morrisons data breach case. Over 9000 Morrisons employees brought a class action against Morrisons, alleging that the company should be held vicariously liable for the leaking of their personal data by an employee. The Court ultimately found in Morrisons’ favour, confirming that the employee who leaked the data was not acting ‘in the course of employment’ and was instead pursuing a personal vendetta. The Claimant’s were represented by JMW Solicitors and the Defendant (Morrisons), by DWF LLP.

Vicarious Liability – some background

Every law student is no doubt familiar with the concept of vicarious liability: the legal principle that someone should be held liable for the wrongful acts of a third party. This is typically seen where there is an employee/employer relationship and the employer is held liable for a tortious act committed by an employee ‘in the course of employment’. Vicarious liability is based on the public policy principle that it is easier for the victim of the wrongdoing to seek redress from an employer, rather than suing the employee privately.

The Facts

In the present case, Mr Skelton was employed by Morrisons as a senior auditor, which meant he often had access to large amounts of employees’ personal data. On the day in question, Skelton was transferring payroll records to the external auditors, but also made a copy of the data for himself, which he subsequently uploaded onto a public data sharing website. This data contained the personal information of around 100,000 employees. Shortly after the breach, Skelton sent information about the leak to three newspapers, pretending to have innocently come across the information. The newspapers informed Morrisons of the leak and the police soon realised it was in fact Skelton who was the perpetrator. Skelton had received a disciplinary from his employer some months earlier.

The employees subsequently brought a claim against Morrisons, alleging the company should be held vicariously liable for breaches under the Data Protection Act, breach of confidence and misuse of private information. The High Court found in favour of the employees and indeed held Morrisons to be vicariously liable. The Court of Appeal agreed with the decision. Morrisons then took their case to the Supreme Court, where they were successful. Skelton was found guilty of fraud and disclosing personal data, among other offences. He received eight years in prison.

The Supreme Court’s Judgement

So why did the Supreme Court come to a different conclusion to the Court of Appeal? Well, they said the lower courts had misunderstood the previous Supreme Court ruling in Mohamud v WM Morrison Supermarkets plc, and instead should have applied the ‘close connection’ test set out in Dubai Aluminium Co Ltd v Salaam.The close connection test states that the wrongful conduct must be so closely connected to what the employee was authorised to do that it would be fair and proper to regard it as being done by the employee while acting in the ordinary course of his employment.

In applying Lord Toulson’s judgement in Mohamud, the Court of Appeal held that because there was a temporal or causal connection between the employee’s acts and the field of activities assigned to him, it was just to hold Morrisons liable. They also said the employee’s motive was irrelevant. However, Lord Reed, who gave the judgement in the present case, said the Court of Appeal had wrongly interpreted Lord Toulson’s judgement, which was not intended to replace the close connection test in Dubai Aluminium, only to supplement and simplify it.

Lord Reed concluded with three main points:

1) The online disclosure was not part of Skelton’s ‘field of activities’ the employer had permitted him to do as a senior auditor. The wrongdoing was therefore not within the course of his employment.

2) A temporal or causal connection alone does not satisfy the close connection test. Lord Reed stated that Lord Toulson had not intended this to be the only criteria needed to satisfy the close connection test and that ‘the close connection test is not merely a question of timing or causation’ (para 26). When considering whether there is a close connection and thus whether it is fair and proper to hold the employer liable, a judgement must be made according to the facts of each individual case.

3) It was highly relevant whether Skelton was acting on his employer’s business or for purely personal reasons. While Lord Toulson in Mohamud had indeed stated the motive of the employee was irrelevant, he meant it was not relevant in that particular case (as it would not have changed the outcome). Lord Reed said the Court of Appeal should have considered the wider context in which this was said.

What does this mean for the law on vicarious liability?

In the present case the Supreme Court clarified the law on vicarious liability. They provided more guidance as to the nature of the acts that are likely to be classified as being ‘within the course of employment’ and also made it clear that motive on the part of the employee is indeed relevant when deciding whether or not to hold an employer vicariously liable.

I would also recommend listening to the UK Law Weekly podcast episode on this case which provides a short overview.