Morrisons have appealed a High Court decision made earlier this year where it was held that a company could be held liable for the criminal actions of a rogue employee who disclosed personal information held by the company about their employees on the internet. The Court of Appeal has upheld the High Court decision. Morrisons remain liable for the data breach under the principles of vicarious liability.

The Appeal in the matter of WM Morrison Supermarkets PLC v Various Claimant’s [2018] EWCA Civ 2339 was heard on 9th and 10th October 2018 and judgment was given on 22nd October. There were three grounds of appeal, The first ground was that the Data Protection Act 1998 (DPA) under which the claim was brought excludes the application of vicarious liability. Secondly the DPA excludes the application of causes of action for misuse of private information and breach of confidence. Thirdly the High Court Judge was wrong to conclude that the wrongful action of the rogue employee occurred during the course of his employment by Morrisons.

The Court of Appeal decided that causes of action for misuse of private information and breach of confidentiality are not excluded by the DPA in respect of the wrongful processing of data within the ambit of the DPA. The High Court Judge was correct to hold that the common law remedy of vicarious liability of the employer in such circumstances was not expressly or impliedly excluded by the DPA.

As to the third ground of Appeal the case law and authorities were considered. It has been clearly established that an employer can be vicariously liable for deliberate wrongdoing by an employee. Motive was irrelevant and there is no exception where the motive is, by causing harm to a third party, to cause financial or reputational damage to the employer. This was one of the points which gave some cause for concern to the High Court judge at the first hearing. The Court of Appeal remarked that “there have been many instances reported in the media in recent years of data breaches on a massive scale caused by either corporate system failures or negligence by individuals acting in the corse of their employment. These might, depending on the facts, lead to a large number of claims against the relevant company for potentially ruinous amounts. The solution is to insure against such catastrophes; and employers can likewise insure against losses caused by dishonest or malicious employees… The fact of a defendant being insured is not a reason for imposing liability, but the availability of insurance is a valid answer to the Doomsday or Armageddon arguments.”

The Court of Appeal confirmed that Morrisons was vicariously liable for the torts committed by the rogue employee against the claimant’s.

Morrisons have indicated an attention to appeal further to the Supreme Court.

See original blog post for more information – https://irhlegal.co.uk/blog/how-responsible-is-an-employer-for-its-employees/