WM Morrison Supermarkets plc v Various Claimants  UKSC 12
Morrisons will not be held vicariously liable for the actions of a disgruntled employee who leaked the personal details and payroll data of almost 100,000 members of staff, the Supreme Court has confirmed.
The Judgment in WM Morrison Supermarkets plc v Various Claimants  UKSC 12 (the Morrisons case) was handed down yesterday alongside a parallel decision in Barclays Bank v Various Claimants  UKSC 13 – the latter case addressing the first stage of the test for vicarious liability: whether the relationship is capable of giving rise to vicarious liability.
The Morrisons case addressed the second stage of the test: whether there is a sufficiently close connection between the employment and the wrongdoing.
This ruling comes after both the High Court and Court of Appeal held that Morrisons was liable to face thousands of claims by its employees for distress caused by the data breach committed by its former employee, auditor Andrew Skelton, who had in January 2014, whilst he was still employed by the supermarket following disciplinary proceedings, posted online the personal details and payroll data of 98,998 Morrisons employees, as well as sending CDs containing this data to various newspapers.
The 2001 case of Lister v Hesley Hall  UKHL 22 set the precedent for the close connection test. In order for vicarious liability to flow it has to be shown that there is a sufficiently close connection between the employee’s duties and the wrongful act. The case involved abuse claims brought by boys against the employers of the abusing warden of their school residence. The Court held that there was a sufficiently close connection between the legitimate intimacy with the boys which the warden’s duties comprised, and the illegitimate intimacy and abuse carried out by the warden.
The scope of the close connection test was widened by the decision in the 2003 case of Mattis v Pollock  1 WLR 2158 where a nightclub doorman stabbed a customer outside the nightclub following an incident in the club earlier that evening. The Court of Appeal found that even though the doorman’s conduct was motivated by revenge, the attack was sufficiently closely related to the doorman’s duties that the nightclub employer of the doorman was vicariously liable to the customer for the injuries caused by the doorman’s actions.
Wider still was the close connection test stretched in a 2016 case against Morrisons (Mohamud v WM Morrison Supermarkets  UKSC 11) where a petrol pump assistant responded to a customer’s enquiry about printing some images from a USB stick with a violent attack against him. The Supreme Court held that Morrisons was vicariously liable for the employee’s actions on the basis that attending to customers and responding to their enquiries was within scope of the employment activities.
Welcome relief then for Morrisons, employers and liability insurers alike is the Supreme Court’s ruling yesterday that Mr Skelton’s actions were not sufficiently closely connected to his employment duties since at the time he committed the data breach he was pursuing a personal vendetta against Morrisons and seeking revenge for the disciplinary proceedings he had previously been subject to. The decision serves to check the limits of employers’ liability for the actions of vengeful employees and highlights an important consideration in the stage 2 test: the full picture of the employment at the time of the wrongdoing.
To view/download this Case Alert as a PDF please click here.
If you would like to know more about this matter, please speak to your contacts at Plexus Law:
Tim Francis, Partner
T: 020 7618 0840 | M: 07889 355 517 | E: firstname.lastname@example.org
Rachel Auld, Solicitor
T: 020 7398 9843 | M: 07790 282 903 | E: email@example.com
Whilst we take care to ensure that the material in this Case Update is correct, it is made available for information only, and no representation is given as to its quality, accuracy, fitness for purpose, or usefulness. In particular, the contents of this Case Update do not give specific legal advice, should not be relied on as doing so, are not a substitute for specific advice relevant to particular circumstances. Plexus Law accepts no responsibility for any loss which may arise from reliance on information or materials published in this Case Update.