WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12
WM Morrison Supermarkets plc v Various Claimants restates the close-connection test for vicarious liability. An employee's wrongful act is not within the course of employment merely because the job created the opportunity to commit it.
Facts
Morrisons employed Andrew Skelton as a senior internal auditor. After receiving a disciplinary warning, he developed a grievance against the company. In the course of his work, he was given payroll data for almost 100,000 employees so that it could be sent to external auditors. Skelton copied the data, later uploaded it to a public file-sharing site and sent it anonymously to newspapers, seeking to harm Morrisons while making the disclosure appear to have come from another employee. He was convicted of criminal offences. A group of affected employees sued Morrisons, alleging direct and vicarious liability for misuse of private information, breach of confidence and breaches of data-protection legislation. The lower courts held Morrisons vicariously liable.
Legal Issue
Was Skelton's deliberate disclosure of payroll data sufficiently closely connected with his authorised work to make Morrisons vicariously liable, despite his purpose of injuring the employer?
Held
The Supreme Court unanimously allowed Morrisons' appeal on vicarious liability. Skelton was authorised to transmit payroll data to the external auditor, but his public disclosure was not a further step in performing that task. He pursued a personal vendetta designed to damage Morrisons. Earlier authority did not make motive irrelevant in all circumstances; motive mattered here because it showed that Skelton was acting for purely personal reasons rather than, however improperly, on his employer's business. Employment had given him the opportunity to obtain the data, but opportunity alone did not establish a close connection. The Court also held that the data-protection legislation did not exclude vicarious liability in principle, although no such liability arose on the facts.
⭐ Legal Principle
An employer is vicariously liable only where the employee's tort is so closely connected with authorised acts that it may fairly be regarded as done in the ordinary course of employment. A personal vendetta is not transformed into employment activity merely because the job supplied the information or opportunity used to commit the wrong.
Significance
The judgment narrows an expansive interpretation of Mohamud v WM Morrison Supermarkets plc and reaffirms the approach in Lister v Hesley Hall. The question is whether the employee was engaged, even misguidedly, in the employer's business or instead pursuing personal ends. Motive is relevant to that classification, though not a separate legal requirement. Decided alongside Barclays Bank plc v Various Claimants, the case demonstrates the two distinct stages of vicarious liability: a qualifying relationship and a close connection between the role and the tort.
Common exam questions about this case
Why was Skelton's authorised access to payroll data insufficient for vicarious liability?
Authorised access explained how he obtained the data, but his later disclosure was not part of the task Morrisons assigned. He copied and published it in order to damage the company and frame another employee. The job therefore supplied an opportunity rather than a sufficiently close connection between the wrongdoing and the ordinary performance of his employment functions.
Was Skelton's motive legally irrelevant under the close-connection test?
No. Motive is not always decisive, but it was relevant because it showed whether Skelton was furthering his employer's business or pursuing a personal vendetta. The Supreme Court explained that earlier cases had been misunderstood. An employee may act wrongly and still act in the course of employment, but Skelton's sole purpose placed his conduct outside it.
Does data-protection legislation prevent vicarious liability in every data-breach case?
No. The Supreme Court rejected the argument that the relevant statutory scheme excluded an employer's vicarious liability for an employee's data-related wrongs. Whether liability arises still depends on ordinary vicarious-liability principles. Morrisons escaped liability because Skelton's disclosure lacked the required close connection with his employment, not because data-protection claims are categorically exempt.