Application in principle of vicarious liability to data protection confirmed however
The Supreme Court has allowed Morrisons’ appeal against the decisions of Langstaff J and upholding him the Court of Appeal that the supermarket chain was vicariously liable to its employees over a leak of payroll data on to the Internet by another of its employees – senior IT auditor Andrew Skelton.
The Supreme Court found that the courts below had misunderstood the principles of vicarious liability and so failed to appreciate that the employee’s criminal disclosure – an act of revenge against Morrisons arising from a previous disciplinary process against him – was not so closely connected with acts which Mr Skelton was authorised to do that for the purposes of Morrisons’ liability to third parties it can fairly and properly be regarded as done by him while acting in the ordinary course of his employment. The employees’ group claim has therefore been dismissed.
On the other aspect of the appeal – whether the Data Protection Act 1998 had excluded the operation of the common law of vicarious liability in relation to breaches of itself, misuse of private information and breach of confidence – the Supreme Court upheld the conclusions of the courts below that the 1998 Act did not have this effect.
5RB’s Jonathan Barnes and Victoria Jolliffe instructed by Nick McAleenan and Laura Wilkinson of JMW LLP acted for the Claimants/Respondents