Does an employer have vicarious liability for the misuse of its employees’ personal and confidential information by another employee’s criminal conduct intended to harm the employer?
Yes, held the court in WM Morrison Supermarkets Plc v Various Claimants.
Mr Skelton, a senior IT internal auditor employed by Morrisons, was asked to send data to Morrisons external auditors in order to undertake the annual audit. He was convicted of fraud and offences under the Computer Misuse Act 1990 and s55 Data Protection Act 1998 (‘DPA’) for sharing employees’ personal data online and disseminating a copy of that data to three national newspapers, he was persuing a personal grudge against Morrisons.
Employees of Morrison’s sought to hold Morrisons had vicarious liability for Mr Skelton’s misuse of their private information and breach of confidence and Morrisons personally liable for breach of statutory duty owed under s4(4) of the DPA.
High Court decision upheld
The Court of Appeal upheld the decision of the High Court that Morrisons did have vicarious liabity.. They rejected Morrisons contention that the DPA excluded the vicarious liability of an employer. Where there was misuse of private information by an employee and for breach of confidence. And on the facts there was a sufficiently close connection between Mr Skelton’s employment and his wrongful conduct. Therefore it to be just to hold Morrisons liable.
Importantly the Court did not accept that there is an exception to the irrelevance of motive. Because where that motive is, by causing harm to a third party, to cause financial or reputational damage to the employer. Accordingly, Mr Skelton’s motive in pursuing his actions were irrelevant. On a practical level the Court suggested that employers should insure against data breaches. Employees will commit these acts because of the large potential liabilities involved.
My Comment: I actually think this is a sound decision, who else would have liability? The affected employees would have no remedy against Skelton. It must then turn to his (Skelton’s) employer. For without his employment, he would not have been able to commit the act! See other pieces on my site relating to the same topic, and also My ever grateful thanks to the Daniel Barnett site for these bulletins. see then at