Company not vicariously liable for acts of employee

Morrison Supermarkets v Various Claimants (Supreme Court) [2020]

The Supreme Court has handed down a very important judgment for all data controllers and processors who were concerned that they could be strictly liable in damages for data security breaches even where the acts of the employee in question were done very deliberately to damage the employer.


The facts were summarised in our previous reports on this case. In both the High Court and the Court of Appeal Morrisons were held liable for the deliberate acts of their disgruntled employee in deliberately publishing a large database of employee records. It is important to note that there was no allegation that Morrisons as a corporate entity had failed to comply with its data security obligations. Morrisons had taken appropriate steps to protect the security of its employees’ personal data.


The Supreme Court overturned the judgments of the lower courts and found that Morrisons was not vicariously liable. In doing so they pointed out that comments in a previous case (quite coincidentally also featuring the supermarket) had seemingly been misinterpreted.

The general principle was established in a case called ‘Dubai Aluminium’ from 2002 namely that the wrongful conduct had to be so closely connected with acts the employee was authorised to do that, for the purposes of potential liability of the employer to third parties, it might fairly and properly be regarded as done by the employee while acting in the ordinary course of their employment.

The disclosure of the data on the internet did not form part of Mr Skelton's functions or field of activities. This was not an act which he was authorised to do. Although there was an unbroken ‘chain of causation’ linking the provision of the data to Mr Skelton for the purpose of transmitting it to the auditors and his disclosing it on the internet, such a connection did not in itself satisfy the close connection test. Whether Mr Skelton was acting on his employer's business or for purely personal reasons was highly material.

The mere fact that Mr Skelton's employment gave him the opportunity to commit the wrongful act was not sufficient to warrant the imposition of vicarious liability. Mr Skelton was not engaged in furthering his employer's business when he committed the wrongdoing. On the contrary, he was pursuing a personal vendetta. His wrongful conduct was not so closely connected with acts which he was authorised to do that it could fairly and properly be regarded as done by him while acting in the ordinary course of his employment.

Points to Note:

back to archive