Vicarious Liability: Various Claimants v Morrisons
- 11th December 2017
- No comments
In a recently decided case, the High Court has held that an employer can be vicariously liable for the criminal actions of a rogue employee in breach of the Data Protection Act (Various Claimants v Wm Morrisons Supermarkets plc).
In 2014, the personal details of almost 100,000 Morrisons employees were deliberately published on the internet and sent to three newspapers. The culprit was a senior IT manager employed by Morrisons. Over 5,500 employees brought claims for breach of the Data Protection Act (DPA), the misuse of private information and breach of confidence.
The High Court considered Morrisons’ liability under the DPA. The culprit had been given access to the data as part of his role, but it had been published from his home and on his personal computer, outside working hours and with the deliberate intent of harming Morrisons.
The court identified only one breach of the DPA namely that “Morrisons had not organised the deletion of the data from his work computer” but found that this failure did not cause any loss as the rule was aimed at the inadvertent retention of data rather than its deliberate misuse.
However the court held that in relation to vicarious liability the issue to be decided was whether or not the employee’s actions had been in the course of his employment and particularly whether his wrongful conduct was closely connected to his authorised duties. The court found that the IT Manager had been entrusted with the data and had received and copied it as part of his role.
The court held that the breach of the DPA (the later publication of the date by the IT Manager) was part of a seamless and continuing sequence of events and that there was sufficient connection with his employment and the wrongful conduct.
This should set alarm bells ringing for all employers particularly with the greater sanctions that will apply for data protection breaches as part of the introduction of GDPR in May 2018.
If you would like to know more about this case or data protection issues please contact Karl Thomas.