Vicarious liability

Vicarious liabilityvicarious liability

Does an employer have vicarious liability for the misuse of its employees’ personal and confidential information by another employee’s criminal conduct intended to harm the employer?

Yes,   held the court in WM Morrison Supermarkets Plc v Various Claimants.

Mr Skelton, a senior IT internal auditor employed by Morrisons, was asked to send data to Morrisons external auditors in order to undertake the annual audit. He was convicted of fraud and offences under the Computer Misuse Act 1990 and s55 Data Protection Act 1998 (‘DPA’) for sharing employees’ personal data online and disseminating a copy of that data to three national newspapers, he was persuing a personal grudge against Morrisons.

Vicarious Liability

Employees of Morrison’s sought to hold Morrisons had vicarious liability for Mr Skelton’s misuse of their private information and breach of confidence and Morrisons personally liable for breach of statutory duty owed under s4(4) of the DPA.

High Court decision upheld

The Court of Appeal upheld the decision of the High Court that Morrisons did have vicarious liabity.. They rejected Morrisons contention that the DPA excluded the vicarious liability of an employer.  Where there was misuse of private information by an employee and for breach of confidence. And on the facts there was a sufficiently close connection between Mr Skelton’s employment and his wrongful conduct. Therefore  it to be just to hold Morrisons liable.

Importantly the Court did not accept that there is an exception to the irrelevance of motive. Because  where that motive is, by causing harm to a third party, to cause financial or reputational damage to the employer. Accordingly, Mr Skelton’s motive in pursuing his actions were irrelevant. On a practical level the Court suggested that employers should insure against data breaches.  Employees will commit these acts because of the large potential liabilities involved.
My Comment: I actually think this is a sound decision, who else would have liability? The affected employees would have no remedy against Skelton.  It must then turn to his (Skelton’s) employer. For without his employment, he would not have been able to commit the act!  See other pieces on my site relating to the same topic,     and also      My ever grateful thanks to the Daniel Barnett site for these bulletins. see then at

Share on Twitter
Share on LinkedIn

Filter Articles

Select Month

Newsletter Sign-up

SUBSCRIBE TO OUR NEWSLETTER and Keep up to date with the latest updates on employment law, and other HR issues.

We will only use your email address to send our newsletter and you can stop receiving them at any time.