The Morrison decision
1. In W M Morrison Supermarkets plc v Various Claimants [2018] EWCA Civ 2339, the Court of Appeal held that an employer may be vicariously liable for the actions of its employees in misusing personal and confidential information, in breach of the Data Protection Act 1998 (“the DPA”).
2. The decision deals with two main issues. First, whether the common law doctrine of vicarious liability of an employer for its employee’s misuse of private information is excluded by the DPA. Second, whether the employer was vicariously liable for the employee’s acts away from the workplace.
3PB's Analysis
3. The facts. A disgruntled employee of the W M Morrison Supermarkets plc (“Morrisons”) copied payroll data from the company onto a personal USB, and later uploaded it to a file sharing website. The data included the personal details of almost 100,000 employees. The employee also shared this data with three newspaper sin the UK.
4. First instance decision. The present proceedings were issued against Morrisons by 5,518 employees for a claim for damages for misuse of private information, breach of confidence and breach of statutory duty under section 4(4) of the DPA. At first instance, Langstaff J rejected the direct liability claim but upheld the vicarious liability claim.
5. The appeal. Morrisons appealed and argued that (a) the DPA excludes vicarious liability; (b) the DPA excludes the application of causes of action for misuse of private information and breach of confidence and/or the imposition of vicarious liability for breaches of the same; and (c) Morrisons was not vicariously liable for its employee’s actions because they were not carried out during the course of his employment.
6. The decision. In relation to (a) and (b) the Court of Appeal held that neither vicarious liability nor the causes of action for misuse of private information or breach of confidence were expressly or impliedly excluded. In the leading judgment the Master of the Rolls provided the following reasons: (i) if Parliament had intended to eradicate substantial common law and equitable rights, it would have said so expressly; (ii) Morrisons was only arguing that the vicarious liability of the causes of actions were excluded, rather than the causes of actions themselves; and (iii) Morrisons was not the data controller and the DPA does not deal with the question of the liability of a third party for the misuse by a data controller.
7. As to the third issue, the Court of Appeal upheld Langstaff J’s findings that the wrongful disclosure of the personal data was part of a seamless and continuous sequence of events, which started with, and were connected with, the disgruntled employee’s employment. This decision is in keeping with the numerous authorities concerning employers being vicariously liable for torts committed away from the workplace, including the recent decision in Bellman v. Northampton Recruitment Ltd [2018] EWCA Civ 2214.
8. The Court acknowledged that the unusual feature of this case was that the disgruntled employee had been aiming to harm Morrisons, and this decision would in essence further assist him with this aim. However, this in itself was not relevant for determining whether Morrisons was vicariously liable.
Impact of the Decision
9. Questions of vicarious liability are highly fact specific and therefore this decision should not be read as imposing a liability on all employers for all of its employees’ actions outside of the work place, in relation to data misuse or otherwise. However, this decision is likely to lead to more claims in connection with large scale data breaches and the potential liability for employer companies is, as the Court of Appeal described, ‘potentially ruinous’. In recognising the serious consequences of its decision, the Court of Appeal commented that the answer was for companies to insure against such losses.
This article intends to state the law at the date indicated above. Although every effort is made to ensure accuracy, this article is not a substitute for legal advice.
3PB’s Business and Commercial Group are specialist commercial barristers that provide advice and legal representation on all aspects of business and commercial law. The Group advise on a broad range of issues, including commercial contracts, the law of business entities, professional negligence, and insolvency.
Nicole Bollard is a Commercial and Property Law barrister specialising in intellectual property.
To view her profile click here.