VICARIOUS LIABILITY - 23.04.2020

Supreme Court rules no vicarious liability for employers

The Supreme Court has overturned the Court of Appeal’s rulings and found for the employers in two key cases on vicarious liability, one relating to alleged sexual assaults and the other a data protection breach. What are the implications?

Vicarious liability test

Vicarious liability involves a two-stage test: (1)  is the relationship capable of giving rise to vicarious liability, i.e. is it one of employment or “akin to employment” ; and (2) was the wrongful act sufficiently closely connected with that (quasi) employment? The Barclays case is concerned with the first stage of the test and the Morrisons case relates to the second stage.

Barclays case

In Barclays Bank plc v Various Claimants 2020 (see Follow up ), the Supreme Court has overturned the Court of Appeal’s decision and held that a self-employed doctor was not in a relationship “akin to employment” when Barclays engaged him to carry out medical examinations on prospective employees. The doctor was in business on his own account and he had a portfolio of patients and clients, only one of which was Barclays. So, Barclays wasn’t vicariously liable for sexual assaults allegedly committed by him on 126 individuals while carrying out those examinations.

Pro advice. Although you can be held vicariously liable for the acts of someone who isn’t your employee, your relationship with them must be sufficiently akin to employment, and this won’t include an independent contractor who is carrying on business on their own account.

Morrisons case

We reported on the Court of Appeal’s ruling in yr.2, iss.7, pg.9 (see Follow up ). In WM Morrison Supermarkets plc v Various Claimants 2020 (see Follow up ). The Supreme Court has now overturned that and held that Morrisons (M) wasn’t vicariously liable for unauthorised breaches of the Data Protection Act 1998 (DPA) committed by an employee (S). In a deliberate attempt to harm his employer, S, a senior IT auditor, had posted the personal payroll data of around 100,000 employees online on a public file sharing site using his personal computer outside his working hours. This resulted in a group of those employees seeking compensation from M for breach of statutory duty under the DPA (now replaced by the GDPR , but the same principles apply). The Supreme Court held that S’s wrongful act was not so closely connected with acts he was authorised to do that it could fairly and properly be regarded as having been done by him while acting “ in the ordinary course of his employment” . The disclosure of the data didn’t form part of S’s functions or field of activities and it wasn’t an act which he was authorised to do. In addition, the question of why S acted wrongfully was highly material - he was pursuing a personal vendetta and wasn’t engaged in furthering M’s business.

Pro advice. This decision confirms you won’t always be liable for data breaches committed by rogue employees, particularly if they’re pursuing their own personal objectives. But do always take all appropriate security measures to guard against such breaches.

Although it didn’t affect the outcome, the Supreme Court also found that under the DPA vicarious liability does apply to breaches of its obligations committed by employees who are data controllers acting in the course of their employment, so leaving the door open for you to be held vicariously liable for data breaches by employees which are in their field of activities.

Barclays Bank plc v Various Claimants 2020

Previous article on vicarious liability

WM Morrison Supermarkets plc v Various Claimants 2020

For you to be vicariously liable for the acts of non-employees, your relationship with them must be akin to employment, so it won’t cover contractors with their own independent businesses. You also won’t always be vicariously liable for an employee’s acts, as they may be held not to have acted in the course of their employment.

© Indicator - FL Memo Ltd

Tel.: (01233) 653500 • Fax: (01233) 647100

subscriptions@indicator-flm.co.ukwww.indicator-flm.co.uk

Calgarth House, 39-41 Bank Street, Ashford, Kent TN23 1DQ

VAT GB 726 598 394 • Registered in England • Company Registration No. 3599719