NB: This is not a personal injury or clinical negligence case, but it concerns employers’ vicarious liability, which is highly relevant to both areas.
The Supreme Court gave guidance on the law of employers’ vicarious liability for the misfeasance of their employees.
Full judgment, dated 1 April 2020
The Court of Appeal had upheld a first instance decision that found the Appellant vicariously liable for its employee’s deliberate and spiteful breach of the Data Protection Act. The Supreme Court found that A was not liable because the act had been done deliberately to spite his employers and so could not be described as sufficiently closely connected to his employment as to justify the imposition of vicarious liability.
This appeal arose from a data breach committed by an employee of the Appellant (“A”), Andrew Skelton (“AS”). AS published payroll information about the Respondents (“Rs”), a number of A’s employees and former employees, on the internet. He did so because of an “irrational grudge” against A following misconduct proceedings (3). Lord Reed, giving the judgment of the court, set out the detail of AS’s actions at paragraph 2 to 8. AS had been provided with the information by A in order for him to perform actions with it on their behalf. However, it was clear that AS’s actions were secretive and deliberately concealed from A. They were also criminal, and he was sentenced to eight years’ imprisonment for having committed them.
Lord Reed summarised the proceedings at paragraphs 9 to 14. Rs brought claims against A for breach of the Data Protection Act (“DPA”) both on A’s own behalf and on the basis that A was vicariously liable for AS’s actions. Langstaff J at first instance had rejected the contention that A was primarily liable but had held that it was vicariously liable. He described AS’s actions following A providing him with the data as “a seamless and continuous sequence of events…an unbroken chain”, echoing Toulson LJ in Mohamud  AC 677. AS’s job had been to disclose the data to others (A’s auditors) and the fact that he in fact disclosed it to others was “closely related” to his job. Toulson LJ also found that the five factors listed by Lord Phillips in Various Claimants v Catholic Child Welfare Society  UKSC 56 was satisfied. He found there was sufficient connection between AS’s acts and his employment to justify A being held liable.
The Court of Appeal agreed. They dismissed the fact that AS’s motive in disclosing the data had been to harm A as irrelevant. There was an issue as to whether or not the DPA excluded vicarious liability.
At paragraph 15 Lord Reed set out the issues, being (i) whether A was vicariously liable and, if so, (ii)(a) whether the DPA excluded vicarious liability for statutory torts and (b) whether the DPA excluded vicarious liability for the torts of misuse of private information and breach of confidence.
The vicarious liability issue is dealt with at paragraphs 16 to 47. Lord Reed began by summarising the interpretation of the Mohamud decision in the courts below. The courts had “treated as critical” (i) the issue of connection between conduct and employment, particularly by way of a temporal or causal chain of events, and (ii) the statement that motive was irrelevant (16). Lord Reed stated that “[t]he resultant approach, if correct, would constitute a major change in the law.”
Lord Reed’s view was that Mohamud was not intended to effect a change in the law, but that a few concluding statements had been taken out of context and treated as if they were legal principles (17). Though in Mohamud it had been argued that the test should be whether or not the tortfeasor was acting in the capacity of a representative of the employer, the court had rejected that argument, holding that the existing test remained good (18). Lord Toulson had summarised the history of vicarious liability, which had been restricted to acts explicitly or implicitly authorised by the employer, albeit inclusive of improper modes of performing such acts. That test had been “stretched to breaking point” in Lister v Hesley Hall Ltd  UKHL 22, which concerned sexual abuse. There the question was broadened to whether or not the acts were sufficiently closely connected to the employment as to justify the imposition of vicarious liability.
At paragraph 22 Lord Reed referenced Dubai Aluminium Co Ltd v Salaam  UKHL 48 and cited a lengthy passage of Lord Nicholls’ judgment, which concludes that a lack of precision in the close connection test is inevitable because of “the infinite range of circumstances where the issue arises.” Lord Reed stated that the close connection test has been applied in the relevant subsequent authorities, although applied differently in child abuse cases because of the special considerations appropriate there (23).
However, he stressed at paragraph 24 that the general principle was not an invitation for the judge simply to apply their own sense of justice to each case – rather they should identify principles from previous cases which explain why vicarious liability should or should not be imposed.
Going back to Mohamud, Lord Reed stated that Toulson LJ had stated the present law as being a consideration of two matters. First, what functions, or field of activities, had been entrusted by the employer to the employee. What was the employee authorised to do? Second, “the court must decide whether there was sufficient connection between the position in which he was employed and his wrongful conduct to make it right for the employer to be held liable under the principle of social justice which goes back to Holt CJ.” That test was also stated in Dubai Aluminium at paragraph 23, in terms of whether the conduct my “fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment.”
In conclusion, Lord Reed stated, Toulson LJ in Mohamud was explicitly reaffirming the test from Lister and Dubai Aluminium.
He then analysed Toulson LJ’s reasoning as to the unbroken sequence of events and motive at paragraphs 27 to 30. In referring to the sequence of events, he found that Toulson LJ had been analysing not their temporality or causality, but rather that the particular chain of events in that case demonstrated that the tortfeasor was still acting in the course of his employer’s business. That was an important point and made the reason for the tortfeasor having committed the tort (an assault) irrelevant. Therefore, the statement that motive was irrelevant was a particular feature of the case, not a general principle (30).
Turning to the present case, at paragraph 31, Lord Reed made fairly short work of the Court of Appeal’s reasoning, saying that they had “misunderstood the principles governing vicarious liability in a number of relevant respects”. AS was clearly not authorised to disclose the data on the internet. The fact that the five Catholic Child Welfare Society factors were satisfied was irrelevant – they were concerned, in cases where the tortfeasor was not an employee, only with whether the relationship was akin to employment*. Further, a temporal or causal link was not enough to satisfy the close connection test. Finally, AS’s motives were highly material, insofar as they went to whether or not AS was acting on his employer’s business.
Lord Reed considered the question afresh from paragraph 32. The real question was “whether Skelton’s wrongful disclosure of the data was so closely connected with the collation and transmission of the data to KPMG that, for the purposes of the liability of his employer to third parties, the disclosure may fairly and properly be regarded as made by him while acting in the ordinary course of his employment.”
Although AS couldn’t have committed the tort without A having given him the data in the course of his employment, mere opportunity was not enough to justify the imposition of liability. Close relation between the tort and the act properly intended by the employer was not enough, because, as Lord Wilberforce had said in Kooragang Investments Pty Ltd v Richardson & Wrench Ltd  AC 462, an employee may so clearly depart from his employment that the employer is not liable.
Regarding the principles set out in previous cases, Lord Reed noted that “[p]erhaps unsurprisingly, there does not appear to be any previous case in which it has been argued that an employer might be vicariously liable for wrongdoing which was designed specifically to harm the employer.” (36) Joel v Morison (1834) 6 C&P 501 had held that an employee who goes on “a frolic of his own” will not make his employer liable – Dubai Aluminium had reaffirmed the same at paragraph 32. Attorney General of the British Virgin Islands v Hartwell  UKPC 12 had held that a police officer who, whilst on duty, had embarked on a personal vendetta, did not make the government liable, again endorsing the “frolic” characterisation. A further example was Warren v Henlys  2 All ER 935. In Bellman v Northampton Recruitment Ltd  EWCA Civ 2214, by contrast, an assault by a manager on a more junior employee in the course of an argument about work matters was committed in the course of the manager’s employment.
All of that meant that, according to Lord Reed:
“In the present case, it is abundantly clear that Skelton was not engaged in furthering his employer’s business when he committed the wrongdoing in question. On the contrary, he was pursuing a personal vendetta, seeking vengeance for the disciplinary proceedings some months earlier. In those circumstances, applying the test laid down by Lord Nicholls in Dubai Aluminium in the light of the circumstances of the case and the relevant precedents, Skelton’s wrongful conduct was not so closely connected with acts which he was authorised to do that, for the purposes of Morrisons’ liability to third parties, it can fairly and properly be regarded as done by him while acting in the ordinary course of his employment.” (47)
A was therefore not liable for A’s acts and the appeal was allowed.
In relation to the issue of whether or not the DPA excluded vicarious liability, those passages are not covered in detail here because they are not relevant to PI or clin neg, but the court found that vicarious liability applied equally to the DPA as it did to any other head of claim.
* This seems very doubtful. The five factors are very explicitly an elucidation of the public policy reasons why, in cases where the relationship is employer-employee, the imposition of vicarious liability is fair. The full text of paragraph 35 is as follows:
The relationship that gives rise to vicarious liability is in the vast majority of cases that of employer and employee under a contract of employment. The employer will be vicariously liable when the employee commits a tort in the course of his employment. There is no difficulty in identifying a number of policy reasons that usually make it fair, just and reasonable to impose vicarious liability on the employer when these criteria are satisfied:
(i) The employer is more likely to have the means to compensate the victim than the employee and can be expected to have insured against that liability;
(ii) The tort will have been committed as a result of activity being taken by the employee on behalf of the employer;
(iii) The employee’s activity is likely to be part of the business activity of the employer;
(iv) The employer, by employing the employee to carry on the activity will have created the risk of the tort committed by the employee;
(v) The employee will, to a greater or lesser degree, have been under the control of the employer.
These factors would appear to be the kind of factors that would assist the court in applying the general principle, so it seems strange that Lord Reed stated that their applicability is limited to occasions when the relationship is not employer-employee.