Share it

On appeal from: [2018] EWCA Civ 2339.

This appeal concerns the circumstances in which an employer is vicariously liable for wrongs committed by its employees, and also whether vicarious liability may arise for breaches by an employee of duties imposed by the Data Protection Act 1998.

The appellant operates a chain of supermarkets and employed Andrew Skelton on its internal audit team. In July 2013, Skelton received a verbal warning after disciplinary proceedings for minor misconduct and bore a grievance against the appellant thereafter. In November 2013, Skelton was tasked with transmitting payroll data for the appellant’s entire workforce to its external auditors, as he had done the previous year. Skelton did so, but also made and kept a personal copy of the data. In early 2014, he used this to upload a file containing the data to a publicly accessible filesharing website. Skelton later also sent the file anonymously to three UK newspapers, purporting to be a concerned member of the public who had found it online. The newspapers did not publish the information. Instead, one alerted the appellant, which took immediate steps to have the data removed from the internet and to protect its employees, including by alerting police. Skelton was soon arrested and has since been prosecuted and imprisoned.

The respondents, some of the affected employees, brought proceedings against the appellant personally and on the basis of its vicarious liability for Skelton’s acts. Their claims were for breach of statutory duty under the 1998 Act, misuse of private information, and breach of confidence. At trial, the judge concluded that the appellant bore no primary responsibility but was vicariously liable on each basis claimed. The judge rejected the appellant’s argument that vicarious liability was inapplicable given the 1998 Act’s content and its foundation in an EU Directive. The judge also held that Skelton had acted in the course of his employment, on the basis of Lord Toulson’s judgment in Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11. The appellant’s subsequent appeal to the Court of Appeal was dismissed.

Held: The Supreme Court unanimously allows the appeal.

The Court concludes that the judge and the Court of Appeal misunderstood the principles governing vicarious liability in a number of respects. First, the online disclosure of the data was not part of Skelton’s “field of activities”, as it was not an act which he was authorised to do. Secondly, the satisfaction of the factors referred to by Lord Phillips in Various Claimants v Catholic Child Welfare Society [2012] UKSC 56 was not to the point: those factors were relevant to whether, where the wrongdoer was not an employee, the relationship between wrongdoer and defendant was sufficiently akin to employment for vicarious liability to subsist. They were not concerned with whether employees’ wrongdoing was so closely connected with their employment that vicarious liability ought to be imposed. Thirdly, a temporal or causal connection alone does not satisfy the close connection test. Finally, it was highly material whether Skelton was acting on his employer’s business or for purely personal reasons.

Considering the question afresh, no vicarious liability arises in the present case. Skelton was authorised to transmit the payroll data to the auditors. His wrongful disclosure of the data was not so closely connected with that task that it can fairly and properly be regarded as made by Skelton while acting in the ordinary course of his employment. An employer is not normally vicariously liable where the employee was not engaged in furthering his employer’s business, but rather was pursuing a personal vendetta. The “close connection” test elucidated by Lord Nicholls in Dubai Aluminium, in light of the cases that have applied it and on the particular facts of the present appeal, is not satisfied.

For judgment, please download: [2020] UKSC 12
For Court’s Press Summary, please download: Court’s Press Summary
For a non-PDF version of the judgment, please visit: BAILII

To watch the hearing, please visit: Supreme Court Website 6 Nov 2019 (Morning) (Afternoon), and 7 Nov 2019 (Morning)