Outcome at a glance
Morrisons won its appeal. It was not vicariously liable for an employee’s wrongful disclosure of payroll data in the circumstances of this case.
Allegations & issues
Affected employees sought to hold Morrisons liable for breaches involving their personal information after another employee disclosed payroll data.
Key rulings & findings
The disclosure was insufficiently connected with the employee’s authorised work. He was pursuing a personal vendetta; employment giving him the opportunity did not itself establish employer liability.
Admissions
The outcome rests on a court determination, not a settlement admission.
Disposition
Morrisons’ appeal unanimously allowed on 1 April 2020.
Penalties, damages & redress
No damages liability was imposed on Morrisons by this appeal.
Restrictions & obligations
The appeal concerned civil employer liability, not a trading restriction.
Access through employment was not enough
An employee entrusted with transmitting payroll information to auditors retained a copy and disclosed it publicly as part of a personal vendetta. The trial court found no primary responsibility on Morrisons’ part but imposed vicarious liability, a conclusion initially upheld on appeal. [1; 2, Background]
The Supreme Court applied the close-connection test. It held that the employee’s opportunity to obtain the information through work did not make his later disclosure an act in the ordinary course of employment. A chronological or causal link to assigned duties was insufficient. [1; 2, Reasons]
The limits of the employer’s victory
The Court distinguished conduct undertaken in the employer’s business from a personal campaign to harm the employer. On these facts, that distinction defeated vicarious liability. The judgment did not imply that an employer can never be responsible for intentional wrongdoing by an employee. [1; 2]
The Court also concluded that the Data Protection Act 1998 did not generally exclude vicarious liability for the statutory and related common-law wrongs under discussion. Morrisons won because the necessary employment connection was absent here, not because data-protection claims were categorically outside the doctrine. [1; 2, Reasons]
THE UNDERLYING RECORD
Primary sources
Read the full documents for their precise wording and context. Regulator summaries are identified separately from court records.
Court record · supremecourt.uk01 · Supreme Court · Case record and judgment ↗Court record · supremecourt.uk02 · Supreme Court · Press summary, 1 April 2020 ↗