www.newlawjournal.co.uk | 8 May 2020 Employment LEGAL UPDATE 9

Vicarious liability: sanity restored

IN BRIEF ffMorrisons had no when A month on from WM Morrison Supermarkets its employee posted sensitive employee v Various Claimants being published, Nicholas data online since he was pursuing a personal vendetta rather than furthering his employer’s Dobson reflects on where things went awry on the business. long & winding road to the final appeal ffDPA does not exclude vicarious liability.

r Bumble in Oliver Twist said if the supposed his wife acts under his direction ‘the law is a ass—a Midiot.’ He therefore wished the eye of the law to ‘be opened by experience’. Many may have felt something similar about the conclusions of the High Court and Court of Appeal in the Morrisons vicarious liability case, where the famous Joel v Morison ‘frolic of his own’ ((1834) 6 C & P 501) seemed to be dead currency. Faith was, however, restored by the Supreme Court on 1 April 2020 which found no vicarious liability when a Morrisons internal auditor, for his own vengeful purposes, went firmly off-piste, posting personal data of 98,998 Morrisons’ employees to a publicly accessible file-sharing website. For the below had ‘misunderstood the © Facundo Arrizabalaga/EPA/Shutterstock principles governing vicarious liability in a number of relevant respects’. The case was of the Data Protection Act 1998 (DPA) under the DPA; (b) Whether the DPA WM Morrison Supermarkets plc v Various (subject to exemptions, data controllers excludes the imposition of vicarious Claimants [2020] UKSC 12, in to comply with the data protection liability for misuse of private information which was given by Lord Reed, with whom principles in Schedule 1 in respect of all and breach of confidence.’ This article will Lady Hale, Lord Kerr, Lord Hodge and Lord material personal data), misuses of private focus on 1. Lloyd-Jones agreed. information and breach of confidence. The claims were for damages for alleged Vicarious liability Background ‘distress, anxiety, upset and damage’. The core Joel v Morison principle will be As part of his duties Morrisons senior Following a group litigation order, there remembered from law school. So where (as internal auditor, Andrew Skelton, sent were ten lead claimants. in Joel) a plaintiff had been knocked down payroll data for the entire workforce to the Morrisons lost in both the High Court and injured by a cart negligently driven by external auditors. However, still aggrieved and Court of Appeal. Like Langstaff J the defendant’s employee, Parke B said that: at a verbal warning previously received below, the Court of Appeal (Sir Terence ‘The master is only liable where the servant for minor misconduct, Skelton also took Etherton MR, Bean and Flaux LJJ) is acting in the course of his employment. steps resulting in the public posting of the emphasised (following Mohamud v WM If he was going out of his way, against his employee data noted. Posing as a concerned Morrison Supermarkets plc [2017] 1 All master’s implied commands, when driving member of the public who had found the file ER 15) that: ‘the relevant facts constituted on his master’s business, he will make his on the relevant website, he also sent the file a “seamless and continuous sequence” or master liable; but if he was going on a frolic data anonymously to three UK newspapers. “unbroken chain” of events.’ And although of his own, without being at all on his But instead of publishing the data, the ‘it was an unusual feature of the case master’s business, the master will not be newspapers alerted Morrisons which that Skelton’s motive in committing the liable’ (emphasis added). acted swiftly to remove the internet data, wrongdoing was to harm his employer, So where did things go awry on the instigate internal investigations and inform Lord Toulson had said in Mohamud that long and winding road to the Supreme the . Morrisons spent more than motive was irrelevant.’ The Court of Appeal Court? Misunderstandings seem to have £2.26m in dealing with the disclosure’s therefore agreed that Morrisons was occurred surrounding the reasoning of Lord immediate aftermath, a significant part vicariously liable for Skelton’s wrongdoing. Toulson in Mohamud. These included ‘the of which included employee identity The issues before the Supreme Court principle of social which goes back protection measures. were: (1) Whether Morrisons is vicariously to Holt’ CJ (i.e. Sir John Holt, LCJ 1642- On the basis that Morrisons was liable for Skelton’s conduct; (2) If the 1710)). This was in Hern v. Nichols (1795) vicariously liable for Skelton’s behaviour, answer to (1) is in the affirmative: (a) concerning proceedings for deceit, where the Claimants had brought proceedings Whether the DPA excludes the imposition one type of silk was offered for sale, but an against Morrisons for its alleged breach of vicarious liability for statutory inferior type actually sold. The deceit was of the statutory duty created by s 4(4) committed by an employee data controller not the merchant’s but that of an overseas 10 LEGAL UPDATE Employment 8 May 2020 | www.newlawjournal.co.uk

factor. Holt CJ nevertheless considered legal principles: principles which would employer with respect to the act he has the merchant to be ‘answerable for the represent a departure from the committed.”’ deceit of his factor, though not criminaliter which Lord Toulson was expressly Lord Reed cited various cases to yet civiliter; for, seeing somebody must following.’ illustrate the above distinction of Lord be a loser by this deceit, it is more reason The Supreme Court indicated that the Nicholl’s between where the employee that he that employs and puts a trust in disclosure of the data on the Internet was ‘however misguidedly’ furthering his and confidence in the deceiver should be formed no part of Skelton’s functions or employer’s business and those where the a loser, than a stranger.’ And in Lloyd v field of activities: it was an unauthorised employee is engaged solely in pursuing Grace, Smith & Co [1912] AC 716 (where a act. And although there was a close his own interests. In the instant clerk purporting to act in the course of temporal link and an unbroken chain of it was therefore ‘abundantly clear that his principal’s business defrauded a client) causation linking the provision of the data Skelton was not engaged in furthering his the Earl of Halsbury said of Hern that: ‘I to Skelton so he could send it to KPMG employer’s business when he committed should be very sorry to see a principle which and his posting of it on the Internet, a the wrongdoing in question.’ Quite the appears to me of very great value shaken by temporal or causal connection does not contrary, ‘he was pursuing a personal any authority.’ in itself satisfy the close connection test. vendetta, seeking vengeance for the However, Lord Reed indicated that Furthermore, the reason that Skelton disciplinary proceedings some months Lord Toulson, citing para [23] of Dubai acted wrongfully was not irrelevant. On earlier’. So, following Lord Nicholls Aluminium Company Ltd v. Salaam and the contrary, whether he was acting on his in Dubai Aluminium and relevant others [2002] UKHL 48 (noted below): employer’s business or for purely personal precedents: ‘Skelton’s wrongful conduct ‘makes it clear that vicarious liability reasons was highly material. was not so closely connected with acts for wrongdoing by an employee is not Lord Nicholls said of vicarious liability which he was authorised to do that, for determined according to individual ’ in paragraph 23 of Dubai that: ‘the best the purposes of Morrisons’ liability to sense of social justice. It is decided by general answer [ie general principle] is third parties, it can fairly and properly be orthodox reasoning, generally the wrongful conduct must be so closely regarded as done by him while acting in based on the application to the case before connected with acts the partner or the ordinary course of his employment.’ the court of the principle set out by Lord employee was authorised to do that, for As to the DPA, the Court concluded Nicholls at para 23 of Dubai Aluminium’ the purpose of the liability of the firm or that: ‘since the DPA neither expressly (emphasis added). the employer to third parties, the wrongful nor impliedly indicates otherwise, Also subject to misunderstanding were conduct may fairly and properly be the principle of vicarious liability references in para [47] of Mohamud to regarded as done by the partner while applies to the breach of the obligations ‘the connection between the employee’s acting in the ordinary course of the firm’s which it imposes, and to the breach of conduct in that case and his employment business or the employee’s employment’ obligations arising at common law or (“an unbroken sequence of events”, (emphasis added). in , committed by an employee or “a seamless episode”), which [the Also in Dubai Aluminium (at para [32]) who is a data controller in the course of courts below] appear to have regarded Lord Nicholls said that: ‘A distinction is his employment, as explained in Dubai as referring to an unbroken temporal to be drawn between cases . . . where Aluminium’. or causal chain of events’ and Lord the employee was engaged, however Morrisons’ appeal was therefore Toulson’s statement in paragraph 48 that misguidedly, in furthering his employer’s allowed since the circumstances in which the motive of Mr. Khan as the principal business, and cases where the employee Skelton committed wrongs against the actor in Mohamud was irrelevant. As Lord is engaged solely in pursuing his own Claimants did not result in the employer Reed said, the ‘resultant approach, if interests: on a ‘frolic of his own’, in the becoming vicariously liable. correct, would constitute a major change language of the time-honoured catch As noted, things apparently went in the law’. phrase. In the former type of case the askew below because a few phrases of Lord Toulson’s judgment, said Lord employee, while seeking to promote his Lord Toulson, ‘taken out of context, were Reed: ‘. . . was not intended to effect a employer’s interests, does an act of a kind treated as establishing legal principles. . . change in the law of vicarious liability: he is authorised to do. Then it may well which would represent a departure from quite the contrary’. That becomes clear be appropriate to attribute responsibility the precedents which Lord Toulson was if the judgment is read as a whole. For for his act to the employer, even though expressly following’. Judicial dicta are not, the judgments below had focused on the the manner of performance was not of course, . And as Lord Steyn said final paragraphs, where Lord Toulson had authorised or, indeed, was prohibited. in R (Daly) v. Secretary of State for the Home summarised long-established principles The matter stands differently when the Department [2001] 2 AC 532, 548, ‘in law, in the simplest terms and applied them to employee is engaged only in furthering context is everything.’ NLJ the facts of the case before him. So a ‘few his own interests, as distinct from those phrases in those paragraphs, taken out of his employer. Then he acts “so as to Nicholas Dobson writes on local government, and governance. of context, were treated as establishing be in effect a stranger in relation to his

From Woodwork Clauses to Garden Leave. Lexis® PSL Employment Practical commercial advice and tools to help you get more done each day today – lexisnexis.co.uk/practice-areas/employment

The Future of Law. Since 1818.