The UK Supreme Court has upheld the employer's appeal is this well-known case. Readers will remember that it involved an senior IT internal auditor, Mr Skelton, at a supermarket who had been entrusted with passing on payroll information of just under 100,000 employees to an external auditor as part of the annual audit. After receiving a formal warning from the employer for the unauthorised use of postal services, the auditor held a grudge. He released the personal data of employees to a file-sharing website.

A group litigation claim was initiated by 5,518 employees/former employees who sued the supermarket for breach of the Data Protection Act 1998, misuse of private information and breach of confidence. It was argued that the supermarket was directly liable and/or vicariously liable for the actions of the internal auditor.

The High Court rejected the argument that the supermarket bore any primary liability but held that there was a ‘sufficient connection’ between the release of the data and the auditor’s employment such that the employer was vicariously liable for his conduct.

The Court of Appeal agreed with the characterisation of the disclosure as ‘a seamless and continuous sequence of events’ and that ‘there was an unbroken thread that linked his work to the disclosure’. The appeal was dismissed.

The Supreme Court has upheld the supermarket's appeal. The Court concluded that the judge and the Court of Appeal misunderstood the principles governing vicarious liability in a number of respects and that the online disclosure of the data was not part of Skelton’s “field of activities”, as it was not an act which he was authorised to do. A temporal or causal connection alone does not satisfy the close connection test. Finally, it was highly material whether Skelton was acting on his employer’s business or for purely personal reasons:

"Considering the question afresh, no vicarious liability arises in the present case. Skelton was authorised to transmit the payroll data to the auditors. His wrongful disclosure of the data was not so closely connected with that task that it can fairly and properly be regarded as made by Skelton while acting in the ordinary course of his employment. On long-established principles, the fact that his employment gave him the opportunity to commit the wrongful act is not sufficient to warrant the imposition of vicarious liability. An employer is not normally vicariously liable where the employee was not engaged in furthering his employer’s business, but rather was pursuing a personal vendetta."
https://www.supremecourt.uk/cases/docs/uksc-2018-0213-judgment.pdf

Explanation on YouTube:
https://www.youtube.com/watch?v=V2Qee_v_1No

Review of 2018 Court of Appeal Decision is available here:
https://www.legal-island.com/articles/uk/case-law/2018/oct/wm-morrison-supermarkets-pls-v-various-claimants-2018/