Big claims but no blame: Morrisons held vicariously liable for data misuse
Sarah Bazaraa

The Court of Appeal has ruled that an employer can be held vicariously liable for the criminal data misuse of individual employees. This decision highlights the broad, sweeping nature of vicarious liability and increases the need for employers to insure against large legal claims.

What is vicarious liability?

Vicarious liability holds employers legally accountable for the wrongdoing of employees during the course of an individual’s employment. It is a form of strict liability, meaning the employer need not be at fault for liability to be established. More recently, the courts have adopted a broad, sweeping test, where any action that is ‘sufficiently connected’ to the ‘field of activities’ of an individual’s employment can render the employer liable.

Morrisons Supermarkets v Various Claimants

This case concerned a begrudged senior IT internal auditor employed by Morrisons who, after being disciplined at work, decided to take home the data of 100,000 employees and place them online. His employment meant he was entrusted with this data, and his misuse of it landed him with 8 years’ imprisonment for breaching the Data Protection Act 1998 (the Act). Over 5,000 of those affected brought a claim against Morrisons alleging that Morrisons was vicariously liable for the actions of its employee.

The High Court ruled that Morrisons had no primary liability to the affected employees and that it had discharged all duties it owed to its employees under the Act. However, the Court of Appeal held that Morrisons’ lack of primary liability for the harm caused did not prevent the data subjects from being entitled to pursue a separate vicarious liability claim.

It was held that despite the employee’s acts of data misuse having been carried out in his home, on his personal laptop and for his own criminal motives, the act was sufficiently connected to the field of activities of his employment. Accordingly, all of those affected by his criminal activity could claim for damages against Morrisons.

The effect of the ruling

This ruling may have serious detrimental effects on innocent employers, for whom the need to have relationships of trust with employees is essential. Morrisons have indicated a desire to appeal the decision to the Supreme Court. For now, however, the possibility of substantial claims against employers for the abuse of such trust is unsettling. With the scope of vicarious liability becoming so extensive, businesses ought to remain mindful of the risks of such claims and consider appropriate insurance packages to protect them from becoming the subject of vicarious liability claims.

Back to homepage