Andrew Skelton, a disaffected employee of Morrison’s Supermarkets, was subjected to disciplinary proceedings for minor misconduct, following which he was given a verbal warning. Skelton was a senior auditor in Morrison’s internal audit team, and his revenge – for which he was subsequently jailed for eight years – was to upload a file containing the personal data of 98,998 of its employees to a publicly-accessible file-sharing website, with links to the data posted on other websites, and to send CDs containing the file – anonymously – to three UK newspapers. The data included the name, address, gender, date of birth, phone numbers, national insurance number, bank sorting code, bank account number and salary of each member of staff [1-8].

The claimants brought proceedings against Morrison’s for an alleged breach of the statutory duty under s.4(4) Data Protection Act 1998 (misuse of private information and breach of confidence) on the basis that Morrison’s was vicariously liable for Skelton’s conduct [9]. The Court of Appeal found for the claimants.

In a unanimous judgment in WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12, however, the Supreme Court held that Morrison’s was not vicariously liable for Skelton’s wrongdoing. The Court concluded that the online disclosure of the data was not part of Skelton’s “field of activities” for which Morrison’s employed him because it was not an act which he was authorised to do. Further, the existing “close connection” test formulated in Dubai Aluminium Co Ltd v Salaam [2002] UKHL 48  was this: whether or not the wrongful conduct was so closely connected with acts that the employee was authorised to do that, for the purposes of the employer’s third-party liability of the employer to third parties, it might fairly and properly be regarded as done by the employee while acting in the ordinary course of his or her employment [22-23].

A temporal or causal connection alone did not satisfy the “close connection test”; and it was highly material whether Skelton was acting on his employer’s business or for purely personal reasons [31]. Skelton had been authorised to transmit the payroll data to Morrison’s Supermarkets’ auditors, KPMG; his wrongful disclosure was not so closely connected with that task that it could fairly and properly be regarded as having been made while acting in the ordinary course of his employment. The fact that his employment gave him the opportunity to commit the wrongful act did not warrant the imposition of vicarious liability. It was

“abundantly clear that Skelton was not engaged in furthering his employer’s business when he committed the wrongdoing in question. On the contrary, he was pursuing a personal vendetta, seeking vengeance for the disciplinary proceedings some months earlier. In those circumstances, applying the test laid down by Lord Nicholls in Dubai Aluminium in the light of the circumstances of the case and the relevant precedents, Skelton’s wrongful conduct was not so closely connected with acts which he was authorised to do that, for the purposes of Morrison’s liability to third parties, it can fairly and properly be regarded as done by him while acting in the ordinary course of his employment” [47].

Comment

The extent of vicarious liability for the actions of employees (and others) has been a critical issue in several recent cases involving religious organisations of various kinds: see, for example:

• BXB v Watch Tower And Bible Tract Society of Pennsylvania & Anor [2020] EWHC 156 (QB);
• A v Watchtower Bible and Tract Society (Trustees of) & Ors [2015] EWHC 1722 (QB);
• CW v Trustees of the Archdiocese of St Andrews and Edinburgh [2013] ScotCS CSOH 185;
• The Catholic Child Welfare Society & Ors v Various Claimants & The Institute of the Brothers of the Christian Schools & Ors [2012] UKSC 56;
• JGE v The Portsmouth Roman Catholic Diocesan Trust [2012] EWCA Civ 938; and
• Maga v Trustees of the Birmingham Archdiocese of the Roman Catholic Church [2010] EWCA Civ 256.

So might the judgment narrow the scope of vicarious liability in future cases? It will be interesting to see what impact – if any – the judgment in Morrison Supermarkets might have on future claims for sexual abuse committed within religious organisations.