Vicarious liability for data security breaches

Morrison Supermarkets v Various Claimants (Court of Appeal) [2018]

The Court of Appeal has upheld a decision that could make employers vicariously liable for their employees’ actions even if they have taken every conceivable preventative step and bear no criminal responsibility. The court upheld a High Court ruling that supermarket chain Morrisons was liable for the actions of former employee Andrew Skelton. Morrisons said it will appeal to the Supreme Court.


The facts of the case are set out in our report on the original High Court decision (see


The Court of Appeal held that the vicarious liability of an employer for misuse of private information by an employee and for breach of confidence by an employee has not been excluded by data protection legislation.

Notwithstanding that Mr Skelton committed the acts complained of: (1) from a personal computer; (2) at home; and (3) outside of working hours; there was, according to the court, a “seamless and continuous sequence” or “unbroken chain” of events linking back to his employment. In coming to that conclusion the judges cited with approval the recent judgment in Bellman v Northampton Recruitment in which it was held that in assessing whether an employer should be held vicariously liable for the acts of an employee the court must assess whether the relevant acts fall “within the field of activities assigned to the employee” and, insofar as this is the case, whether there is a "sufficient connection" between the position in which the employee was employed and the relevant act for liability to attract to the employer. The Court of Appeal held that in this case "the tortious acts of Mr Skelton in sending the claimants’ data to third parties were within the field of activities assigned to him by Morrisons" and that an employer could be vicariously liable even where the intention of the employee committing the relevant act "was to harm his employer rather than to achieve some benefit for himself or to inflict injury on a third party". The employee's motive in committing the relevant act is seemingly irrelevant.

Points to Note: