Where a primary tortfeasor is an individual, a lack of financial means with which to meet a judgment debt will often mean it is not worth pursuing them alone. Even employees in senior management positions are unlikely to be able to meet a substantial money judgment arising out of a tort committed in connection with their employment.
The law on vicarious liability is therefore of immense practical significance for litigators across the whole range of civil disputes.
In its latest decision on vicarious liability, Wm Morrison Supermarkets plc v Various claimants, the Supreme Court has rejected the lower courts’ so-called “misunderstandings” of its 2016 decision in Mohamud v WM Morrison Supermarkets plc, and reasserted the protections the law provides to employers faced with the destructive acts of deviant employees.
The facts
In short, Andrew Skelton was employed by the company, Morrisons, as part of its internal audit team. In 2013, Mr Skelton was the subject of disciplinary proceedings within the company as a result of which he harboured a grudge against the company.
Later that year, Mr Skelton was tasked with sending the company’s entire payroll data to the company’s external auditors. This limited transmission was expressly authorised by the company.
However, without authorisation, Mr Skelton also made a copy of the data. He later illegally disclosed the data to an online file-sharing site and certain UK media outlets in retaliation against Morrisons for his 2013 disciplinary proceedings.
The data breach was discovered and Mr Skelton was sentenced to eight years’ imprisonment on fraud charges.
The claims
A large minority (approximately 9,000) of the employees whose personal data had been compromised brought claims against Morrsions, as Mr Skelton’s employer, alleging that the company was either principally or vicariously liable for breach of statutory duty under the Data Protection Act 1998 and common law claims in misuse of private information and breach of confidence.
Pursuant to the terms of a group litigation order by the High Court, ten lead claimants were permitted to litigate their claims to trial.
The judgment of the Supreme Court, and therefore this blog, is limited to consideration of the claimants’ secondary (that is, vicarious) liability claim against Morrisons.
The Supreme Court
Applying the principles in Mohamud, both the High Court and Court of Appeal held the company vicariously liable for the torts committed by Mr Skelton in leaking the data. The claimants’ argument that the company was primarily liable for breach of duty was dismissed.
The Supreme Court reversed this decision, holding that, on the principles elucidated in Mohamud, the company was not vicariously liable for the torts committed by Mr Skelton.
The basic test for imposing vicarious liability in this case was whether Mr Skelton’s tortious act(s) in effecting the data breach was so closely connected with his employment by the company that it would be fair and just to hold the company liable for the same (the close connection test).
As Lord Toulson explained in Mohamud, the close connection test requires consideration of:
- What functions or “field of activities” had been entrusted by the company to Mr Skelton pursuant to his employment.
- Whether there was a sufficient connection between the position in which Mr Skelton was employed and his tortious conduct in effecting the data breach so as to make it just and reasonable to hold the company vicariously liable for the same.
One of the most striking remarks of Lord Reed’s lead judgment in Morrisons, at paragraph 31, is that the High Court and Court of Appeal had “misunderstood the principles governing vicarious liability in a number of relevant respects”. In these respects, the Supreme Court held that:
- Mr Skelton’s unauthorised disclosure of the data on the internet did not fall within the “field of activities” with which he had been entrusted by the company.
- It was irrelevant to the close connection test that the five factors set out in Various claimants v Catholic Child Welfare Society were made out on the facts. The factors in Catholic Child Welfare Society are relevant to the anterior question of the relationship between the primary tortfeasor and the defendant employer in relation to which vicarious liability is alleged. They do not inform the secondary close connection test.
- It will not be enough to establish vicarious liability that the employee’s employment gave the employee the opportunity to commit the tort (in Morrisons, the unlawful copying and disclosure of the data), or that there is an unbroken chain of causation between the opportunity afforded by the employer to the employee to commit that tort and the actual commission of the tort in question.
- Contrary to the view of the lower courts in this case, the motives of Mr Skelton in committing the data breach was “highly material” to the close connection test. Courts in future will need to have careful regard to whether the employee was acting for his or her own personal reasons or, even nominally, in pursuit of the employer’s business.
Key points for litigators
A number of important points arise.
First, the Supreme Court was clear that, although the law on vicarious liability clearly requires a value judgment, including consideration of social justice principles, liability must only be imposed on a careful and detailed consideration of the relevant factors and principles, which must guide the court’s decision-making. As Lord Reed put it at paragraph 24 in Morrisons:
“The words “fairly and properly” [within the test stated by the House of Lords in Dubai Aluminium Co Ltd v Salaam [2003] 2 AC 366] are not… intended as an invitation to judges to decide cases according to their personal sense of justice, but require them to consider how the guidance derived from decided cases furnishes a solution to the case before the court. Judges should therefore identify from the decided cases the factors or principles which point towards or away from vicarious liability in the case before the court, and which explain why it should or should not be imposed. Following that approach, cases can be decided on a basis which is principled and consistent.” (Emphasis added.)
It is fair to say that this is less a statement of technical importance than a warning against judicial laziness. Judges deciding vicarious liability claims are not simply tasked with “doing justice”, and it is certainly not sufficient merely to find the deepest pockets (a point highlighted in Lord Pannick’s submissions on behalf of the appellant during the hearing).
This instruction to the lower courts should provide some optimism to defendant employers (and their insurers) facing claims arising out of their employees’ conduct, although they should remain wary of accompanying claims for breach of the employer’s own duties in relation to the employee’s conduct, which are unaffected by this decision.
On the other hand, claimants and their lawyers will need to give careful thought as to the relevance of:
- The nature of the employee’s job.
- The kinds of tasks which that employee was asked to do by the employer, whether routinely or as a one-off leading up to the commission of the tort.
- The express or implied limitations, if any, imposed by the employer on the authorisations given to the employee.
- The nature and extent of the opportunities afforded to the employee to commit the relevant torts by the employer.
- The motivations of the employee in carrying out the tort(s).
Second, I expect that future first instance decisions on vicarious liability will grapple in greater detail with the motive of the primary tortfeasor in deciding to commit the tort, which the Supreme Court has described as “highly material” to the close connection test.
Morrisons may therefore be of particular interest to fraud litigators. The employers of employees committing torts such as conspiracy or dishonest assistance in concert with parties other than the employer have in the past been fixed with vicarious liability for the same: see, for example, the Court of Appeal’s post-Mohamud decision in Group Seven and another v Notable Services LLP and others, from paragraphs 114 to 156.
The Supreme Court’s restatement in Morrisons of the relevance of the employee’s motive throws up interesting questions in a fraud context. Fraudsters’ primary motivations are usually selfish, and will very often directly conflict with the interests of the employer.
Fraud litigators should therefore also give renewed focus to eliciting their clients’ best evidential points on the question of motive, which could become an important battleground where vicarious liability is alleged. Mr Skelton’s motive in Morrisons was clear on the facts, but in other cases the employee’s specific motive will not always be clear (and will often be disputed).
Third, there will of course be costs consequences for failed vicarious liability claims, even where the primary tortfeasor’s liability is established. It is notable, therefore, that defendant employers’ costs (and an unsuccessful claimant’s exposure) are often greater than the primary tortfeasor’s costs.
A claimant will have a doubly pyrrhic victory if they succeed against D1 (whom it is known is unlikely to be able to meet the primary judgment or any costs order made against him/her) but fail against D2 (with its bigger pockets), and be left at the end of the trial:
- Defending a claim from D2 in respect of its costs.
- Unable to enforce the primary judgment debt or its own costs award against D1 for D1’s lack of means.
In light of the Morrisons decision, early consideration and advice should be given as to whether to proceed against defendant employers in borderline cases.
Conclusion
Arguments as to the scope of an employer’s responsibility for the tortious acts of its employees (including, and perhaps particularly, in respect of intentional torts) raise important questions about social justice and risk allocation.
Such claims are also of immense practical significance to wronged claimants, defendant employers, and the insurance sector. Cases like Morrisons highlight just how significant a defendant or insurer’s financial exposure can be (the claim having been pleaded at £55 million in addition to the millions already spent by Morrisons in the immediate aftermath of Mr Skelton’s data breach). Whatever the result of a given case, at least one “innocent” (that is, non-wrongdoing) party will lose out.
All parties to a claim involving alleged vicarious liability (whether in progress or contemplation) should give careful consideration of the merits of their position in light of Morrisons. Early and detailed advice will save time and money in the long run.
