UK: Court of Appeal upholds employer vicarious liability for employee data breach and serious assault

The Court of Appeal has upheld the High Court decision in Morrisons Supermarkets Plc v Various Claimants that an employer can be vicariously liable for an employee’s misuse of data even where it has done as much as reasonably possible to prevent the misuse and the employee's intention was to cause reputational or financial damage to the employer.  

In July 2015, a former Morrisons’ employee was found guilty of stealing and unlawfully sharing the names, addresses, bank account, salary and national insurance details of almost 100,000 of his former colleagues with news outlets and data sharing websites. The Court of Appeal held that Morrisons was vicariously liable for his actions, on the basis that sending data to third parties was within the "field of activities" assigned to the employee as a senior auditor and there was sufficient connection between his job and the wrongful conduct to make it right for the employer to be held vicariously liable. Morrisons is seeking leave to appeal to the Supreme Court.

The fear for organisations will now be that this decision, combined with the legislative changes made by the EU General Data Protection Legislation ("GDPR"), increased public awareness of data protection issues, and the publicity that the case has attracted, could spark a new wave of court cases from workers and customers in the event of a data breach. If the data breach affects large numbers of individuals, the total potential liability for organisations could become commensurately large. The Court of Appeal suggested that insurance could be the answer to "Doomsday or Armageddon arguments" about the effect of its decision. It remains to be seen how the insurance market will react to this enhanced exposure and whether insurance will be an effective tool to offset the increased risks that organisations now face. Our data protection team has published a detailed ebulletin on the ruling available here.

[UPDATE: in April 2019 the Supreme Court gave permission to appeal this decision.]

In Bellman v Northampton Recruitment Ltd, the Court of Appeal applied the same test for vicarious liability to hold an employer responsible for a managing director's drunken assault on a colleague leading to very serious personal injury. The incident took place at drinks following on from the company Christmas party, when the managing director (and also owner of the company) was lecturing the staff present to assert his authority and took exception to a colleague questioning one of his decisions. The director was responsible for all management decisions in a relatively small "round-the-clock" company, the drinks had followed on from a work event and the director had chosen to wear his "metaphorical managing director's hat" by delivering the lecture; as such he was not merely one of a group of drunken colleagues whose conversation turned to work. The attack could therefore be seen as a misuse of his authority and was sufficiently connected with his job for vicarious liability to be imposed. The circumstances were unusual, but the case does highlight the risk of vicarious liability being imposed even for criminal conduct depending on the facts. One to bear in mind as the party season approaches…