Al Wakeelo
Your Digital Lawyer, Always on Duty
Initializing Secure Chambers
Your Digital Lawyer, Always on Duty
Initializing Secure Chambers
Petitioner: MW Morrison Supermarkets PLC VS Respondent: Various Claimants
Court Name: Supreme Court of United Kingdom Judge(s): Lord Reed, Lord Hodge, Lady Hale, Lord Lloyd Jones, Lord Kerr Title: MW Morrison Supermarkets PLC vs Various Claimants Case No.: (On appeal from [2018] EWCA 2339) Date of Judgment:2020-04-01 Reported As: 2020 P SC 1059, 2020 SCMR 737 Result: Appeal allowed
JUDGMENT
JUDGMENT LORD REED: (with whom Lady Hale, Lord Kerr , Lord Hodge and Lord Lloyd-Jones agree) 1. This appeal is primarily concerned with the circumstances in which an employer is vicariously liable for the conduct of its employees, and provides the court with an opportunity to address the misunderstandings which have arisen since its decision in the case of Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11; [2016] AC 677. It also raises an important question about the Data Protection Act 1998 ("the DPA"). The facts 2. The appellant, Morrisons, is a company which operates a chain of supermarkets. The respondents are 9,263 of its employees or former employees. I shall refer to them as the claimants. Perso nal information about them was published on the Internet by another of Morrisons' employees, Mr Andrew Skelton. 3. At the material time, Skelton was a senior auditor in Morrisons' internal audit team. In July 2013 he was subject to disciplinary proceedings for minor misconduct and was given a verbal warning. Following those proceedings, he harboured an irrational grudge against Morrisons, which led him to make the disclosures in question. 4. Morrisons' accounts are subject to an annual external audit. In preparation for the audit, on 1 November 2013 the auditors, KPMG, requested payroll data from Morrisons in order to test their accuracy . The head of Morrisons' internal audit team delegated the task of collating and transmitting the data to Skelton. He had also performed that task in 2012. To enable him to carry out the task, he was given access to the payroll data relating to the whole of Morrisons' workforce: around 126,000 employees. These consisted of the name, address, gender , date of birth, phone numbers, national insurance number , bank sorting code, bank account number and salary of each member of staf f. 5. On 9 October 2013 Skelton had searched, using his work computer , for "Tor", a software which is capable of disguising the identity of a computer which has accessed the Internet. On 7 November he made an internal request
---
## Page 2
for the payroll data. On 14 November he obtained a pay- as you-go mobile phone, which could not be traced back to him. 6. On 15 November 2013 the payroll data was provided to Skelton so that he could carry out his task. On a date between then and 21 November , he transmitted the data to KPMG as he had been instructed to do. On 18 November , he surreptitiously copied the data from his work laptop on to a personal USB stick. On 8 December he used the username and date of birth of a fellow employee, Mr Andrew Kenyon, to create a false email account, in a deliberate attempt to frame him. Mr Kenyon had been involved in the disciplinary proceedings earlier that year. The email account was linked to the pay-as-you-go phone. He then deleted the data from his work laptop. 7. On 12 January 2014 Skelton uploaded a file containing the data of 98,998 of the employees to a publicly accessible file-sharing website, with links to the data posted on other websites ("the disclosure"). The file was created from the personal copy of the data which he had made on his USB stick on 18 November . He made the disclosure when he was at home, using the mobile phone, the false email account and Tor. Having made the disclosure, he deactivated the email account, and on 12 March deleted the data and the file from the USB stick. 8. On 13 March 2014, the day on which Morrisons' financial results were due to be announced, Skelton sent CDs containing the file anonymously to three UK newspapers. He purported to be a concerned member of the public who had found the file on the file-sharing website. The newspapers did not publish the data. Instead, one of them alerted Morrisons. Within a few hours, Morrisons had taken steps to ensure that the data was removed from the Internet, instigated internal investigations, and informed the police. It also informed its employees and undertook measures to protect their identities. Skelton was arrested a few days later. He was subsequently convicted of a number of offences and sentenced to eight years' imprisonment. It was noted that Morrisons had spent more than 2.26m in dealing with the immediate aftermath of the disclosure. A significant element of that sum was spent on identity protection measures for its employees. The proceedings below 9. The claimants brought proceedings against Morrisons for its own alleged breach of the statutory duty created by section 4(4) of the DPA, misuse of private information, and breach of confidence. The claims are also brought on the basis that Morrisons is vicariously liable for Skelton's conduct. The particulars of claim do not specify the respects in which that conduct is alleged to have been wrongful on his part, but the claimants' argument before the judge was that vicarious liability arose under the same three heads: breach of the DPA, misuse of private information and breach of confidence. The claims are for damages in respect of alleged "distress, anxiety , upset and damage". 10. The High Court made a group litigatio n order in connection with the claims. Ten lead claimants were selected, with the remainder of the claims being stayed pending judgment. The claimants' solicitors have provided details of the circumstances of each of the lead claimants, so far as considered relevant to the quantification of damages. These describe how the disclosure caused the claimants to experience feelings of anxiety and anger . The trial of liability was separated from the trial of quantum, which has not yet taken place. 11. The trial judge, Langstaf f J, rejected the contention that Morrisons was under a primary liability in any of the respects alleged, but held that it was vicariously liable for Skelton's breach of statutory duty under the DPA, his misuse of private information, and his breach of his duty of confidence: [2017] EWHC 3113 (QB); [2019] QB 772. He rejected Morrisons' argument that vicarious liability could not attach to a breach of the DPA by Skelton as the data controller of the data copied on to his USB stick and subsequently disclosed by him, holding that the object of Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("the Directive"), transposed by the DPA, was the protection of data subjects, and that if vicarious liability did not apply , the purpose of the Directive would be defeated. He also rejected Morrisons' argument that the DPA excluded vicarious liability for misuse of private information or breach of confidence, holding that since the purpose of the Directive, and therefore of the DPA, was the protection of data subjects, it should be treated as providing additional protection rather than as replacing such protection as already existed under domestic law .
---
## Page 3
12. Finally , he rejected Morrisons' argument that Skelton's wrongful conduct was not committed in the course of his employment, holding that Morrisons had provided him with the data in order for him to carry out the task assigned to him, and that what had happened thereafter was "a seamless and continuous sequence of events ... an unbroken chain" (para 184). That languag e was taken from the judgment of Lord Toulson in Mohamud ([2016] AC 677, para 47). He added that Morrisons trusted Skelton to deal with confidential information, and took the risk that it might be wrong in placing that trust in him. His role in respect of the payroll data was to receive and store it, and to disclose it to "a third party". That "in essence" was his task: the fact that he disclosed it to others than KPMG was not authorised, but was nonetheless "closely related" to what he was tasked to do. The five factors listed by Lord Phillips in Various Claimants v Catholic Child Welfare Society [2012] UKSC 56; [2013] 2 AC 1, para 35, were all present. The judge concluded ([2019] QB 772, para 195): "Adopting the broad and evaluative approach encouraged by Lord Toulson JSC in Mohamud's case [2016] AC 677 I have therefore come to the conclusion that there is a sufficient connection between the position in which Skelton was employed and his wrongful conduct, put into the position of handling and disclosing the data as he was by Morrisons (albeit it was meant to be to KPMG alone), to make it right for Morrisons to be held liable 'under the principle of social justice which goes back to Holt CJ'." The latter quotation was taken from Lord Toulson's judgment in Mohamud , para 45. 13. Morrisons' appeal to the Court of Appeal (Sir Terence Etherton MR, Bean and Flaux LJJ) was dismissed: [2018] EWCA Civ 2339; [2019] QB 772. .The court stated at para 37 that there was no pleaded claim against Morrisons on the ground of vicarious liability for Skelton's breach of the DPA. It was conceded that the causes of action for misuse of private information and for breach of confidence were not excluded by the DPA. The court considered that there was nothing in the DP A which excluded vicarious liability for such conduct. 14. In relation to the question whether , on the facts, Morrisons were vicariously liable for Skelton's wrongdoing, the court found at para 72 that "[t]he tortious acts of Mr Skelton in sending the claima nts' data to third parties were in our view within the field of activities assigned to him by Morrisons". Like the judge, the court also emphasised at para 74 that the relevant facts constituted a "seamless and continuous sequence" or "unbroken chain" of events. Although it was an unusual feature of the case that Skelton's motive in committing the wrongdoing was to harm his employer , Lord Toulson had said in Mohamud that motive was irrelevant. The court therefore agreed with the judge that Morrisons was vicariously liable for Skelton's wrongdoing. 15. Notwithstanding the pleading point raised by the Court of Appeal, the issues in the present appeal are agreed to be the following: (1) Whether Morrisons is vicariously liable for Skelton's conduct. (2) If the answer to (1) is in the af firmative: (a) Whether the DPA excludes the imposition of vicarious liability for statutory torts committed by an employee data controller under the DP A. (b) Whether the DPA excludes the imposition of vicarious liability for misuse of private information and breach of confidence. I shall consider the issues in that order . Whether Morrison is vicariously liable for Skelton's conduct The Mohamud decision 16. The courts below applied what they understood to be the reasoning of Lord Toulson in Mohamud [2016] AC 677. They treated as critical, in particular , his reference in para 45 of his judgment to "the principle of social justice which goes back to Holt Cr, his referenc es in para 47 to the connection between the employee's conduct in that case and his employment ("an unbroken sequence of events", or "a seamless episode"), which they appear to have regarded as referring to an unbroken temporal or causal chain of events, and his statement in para 48 that "Mr Khan's motive is irrelevant", Mr Khan being the employee whose conduct was in question in that case. The resultant approach, if correct, would constitute a major change in the law . 17. Lord Toulson's judgment was not intended to effect a change in the law of vicarious liability: quite the contrary . That becomes clear if the judgment is read as a whole, as I shall explain. The judgments below focused on the final
---
## Page 4
paragraphs, in which Lord Toulson summ arised long-established principles in the simplest terms and applied them to the facts of the case then before the court. A few phrases in those paragraphs, taken out of context, were treated as establishing legal principles: principles which would represent a departure from the precedents which Lord Toulson was expressly following. 18. The question which arose on the facts of Mohamud was whether the employer of a petrol station attendant was liable for an assault which the attendant had perpetrated on a motorist. The motorist went into the sales kiosk and asked if some documents could be printed. The attendant, Mr Khan, refused the request and ordered the motorist to leave, using racist and threatening language, then followed the motorist back to his car, opened the door and ordered him never to come back, again using threatening language. When the motorist told Mr Khan to close the door, Mr Khan assaulted him. The judge dismissed a claim against the employer on the ground that Mr Khan's actions were beyond the scope of his employment. An appeal against that decision was dismissed by the Court of Appeal ([2014] EWCA Civ 116; [2014] 2 All ER 990). The argument in the appeal to this court was that the test of vicarious liability should be broadened so as to turn, in the case of a tort committed by an employee, on whether a reasonable observer would have considered the employee to be acting in the capacity of a representative of the employer at the time of committing the tort. The court rejected that argument holding that the established test remained good without need of further refinement. Applying the established test, however , the court allowed the appeal on the facts of the case. 19. In his judgment, with which the other members of the court agreed, Lord Toulson described the origins and development of vicarious liability , explaining, amongst other matters, the influential role which Sir John Holt CJ had played during the late 17th and early 18th centuries, when the doctrine was broadened in response to the expansion of commerce and industry . The Chief Justice had explained the doctrine as resting on the principle that, where an employer employed the wrongdoer , and the employee committed a wrongful act against the claimant within the area of the authority given to him, it was fairer that the employer should suffer for the wrongdoing than the person who was wronged. 20. Lord Toulson went on to refer to the familiar formula introduced by Sir John Salmond in the first edition of Salmond on Torts (1907), pp 83-84, and repeated in later editions, which defined a wrongful act by a servant in the course of his employment as "either (a) a wrongful act authorised by the master or (b) a wrongful and unauthorised mode of doing some act authorised by the master", with the amplification that a master is liable for acts which he has not authorised if they are "so connected with acts which he has authorised, that they may rightly be regarded as modes - although improper modes - of doing them" (Lord Toulson's emphasis: [2016] AC 677, para 25). Lord Toulson explained that, although Salmond's formula was applied in many cases over the course of the 20th century , it was not universally satisfactory , particularly in cases concerned with deliberate acts of misconduct. 21. As Lord Toulson explained, the Salmond formulation was stretched'to breaking point in Lister v Hesley Hall Ltd [2001] UKHL 22; [2002] 1 AC 215, which concerned the sexual abuse of children by the warden of a school boarding house. Even on its most elastic interpretation, the sexual abuse of children could not be described as a mode, albeit an improper mode, of caring for them. Lord Steyn (with whom Lord Hutton and Lord Hobhouse of Woodborough agreed) said that it was not necessary to ask whether the acts of sexual abuse were modes of doing authorised acts. He posed the broader question whether the warden's torts were so closely connected with his employment that it would be just to hold his employers liable. He concluded that they were, stating at para 28 that "the sexual abuse was inextricably interwoven with the carrying out by the warden of his duties". Lord Millett, in a passage in his speech which proved to be influential in later cases, suggested at para 69 that the Salmond formulation could be adapted "to impose vicarious liability where the unauthorised acts of the employee are so closely connected with acts which the employer has authorized that they may properly be regarded as being within the scope of his employment". 22. The "close connection" approach to vicarious liability was considered again by the House of Lords in Dubai Aluminium Co Ltd v Salaam [2002] UKHL 48; [2003] 2 AC 366, a case of commercial fraud committed by one of the partners in a firm. In a passage which is of particular 'importance, and which Lord Toulson cited in Mohamud , at para 41, Lord Nicholls of Birkenhead (with whom Lord Slynn and Lord Hutton agreed) said:
---
## Page 5
"22. ... it is a fact of life, and therefore to be expected by those who carry on businesses, that sometimes their agents may exceed the bounds of their authority or even defy express instructions. It is fair to allocate risk of losses thus arising to the businesses rather than leave those wronged with the sole remedy , of doubtful value, against the individual employee who committed the wrong. To this end, the law has given the concept of 'ordinary course of employment' an extended scope. 23. If, then, authority is not the touchsto ne, what is? ... Perhaps the best gene ral answer is that the wrongful conduct must be so closely connected with acts the partner or employee was authorised to do that, for the purpose of the liability of the firm or the employer to third parties, the wrongful conduct may fairly and properly be regarded as done by the partner while acting in the ordinary course of the firm's business or the employee's employment. Lord Millett said as much in Lister v Hesley Hall Ltd ... 25. This 'close connection' test focuses attention in the right direction. But it affords no guidance on the type or degree of connection which will normally be regarded as sufficiently close to prompt the legal conclusion that the risk of the wrongful act occurring, and any loss flowing from the wrongful act, should fall on the firm or employer rather than the third party who was wronged ... 26. This lack of precision is inevitable, given the infinite range of circumstances where the issue arises. The crucial feature or features, either producing or negativing vicarious liability , vary widely frem one case or type of case to the next. Essentially the court makes an evaluative judgment in each case, having regard to all the circumstances and, importantly , having regard also to the assistance provided by previous court decisions. In this field the latter form of assistance is particularly valuable." (Original emphasis) 23. In that passage, Lord Nicholls identified the general principle ("the best general answer", as he said at para 23) applicable to vicarious liability arising out of a relationship of employment: the wrongful conduct must be so closely connected with acts the employee was authorised to do that, for the purposes of the liability of the employer to third parties, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment. That test was repeated in later cases such as Bernard v Attorney General of Jamaica [2004] UKPC 47; [2005] IRLR 398, Brown v Robinson [2004] UKPC 56, and Majrowski v Guy's and St Thomas's NHS Trust [2006] UKHL 34; [2007] 1 AC 224. As Lord Phillips noted in Various Claimants v Catholic Child Welfare Society [2013] 2 AC 1, paras 83 and 85, the close connection test has been applied differently in cases concerned with .the sexual abuse of children, which cannot be regarded as something done by the employee while acting in the ordinary course of his employment. Instead, the courts have emphasised the importance of criteria that are particularly relevant to that form of wrongdoing, such as the employer's conferral of authority on the employee over the victims, which he has abused. 24. The general principle set out by Lord Nicholls in Dubai Aluminium , like many other principles of the law of tort, has to be applied with regard to the circumstances of the case before the court and the assistance provided by previous court decisions. The words "fairly and properly" are not, therefore, intended as an invitation to judges to decide cases according to their personal sense of justice, but require them to consider how the guidance derived from decided cases furnishes a solution to the case before the court. Judges should therefore identify from the decided cases the factors or principles which point towards or away from vicarious liability in the case before the court, and which explain why it . should or should not be imposed. Following that approach, cases can be decided on a basis which is principled and consistent. 25. Having explained how the close connection case was expressed in Lister and elaborated in Dubai Aluminium , and having also explained that it had been applied in a number of subsequent cases at the highest level, Lord Toulson summarised the present law in paras 44-46 of his judgment ([2016] AC 677). "In the simplest terms", he said, the court had to consider two matters. The first question was what functions or "field of activities" had been entrusted by the employer to the employee. In other words, as Lord Nicholls put it in Dubai Aluminium at para 23. it is necessary to identify the "acts the ... employee was authorised to do". Secondly , Lord Toulson said at para 45, "the court must decide whether there was sufficient connection between the position in which he was employed and his wrongful conduct to make it right for the employer to be held liable under the principle of social justice which goes back to Holt CJ". That statement, expressly put in the simplest terms , was more fully, stated by Lord
---
## Page 6
Nicholls in Dubai Aluminium [2003] 2 AC 366, para 23: in a case concerned with vicarious liability arising out of a relationship of employment, the court generally has to decide whether the wrongful conduct was so closely connected with acts the employee was authorised to do that, for the purposes of the liability of his employer , it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment. That statement of the law, endorsed in Mohamud and in several other decisions at the highest level, is authoritative. 26. Lord Toulson was not suggesting any departure from the approach adopted in Lister and Dubai Aluminium . His position was the exact opposite. Nor was he suggesting that all that was involved in determining whether an employer was vicariously liable was for the court to consider whether there was a temporal or causal connection between the employment and the wrongdoing, and whether it was right for the employer to be held liable as a matter of social justice. Plainly , the close connection test is not merely a question of timing or causation, and the passage which Lord Toulson cited from Dubai Aluminium makes it clear that vicarious liability for wrongdoing by an employee is not determined according to individual judges' sense of social justice. It is decided by orthodox common law reasoning, generally based on the application to the case before the court of the principle set out by Lord Nicholls at para 23 of Dubai Aluminium , in the light of the guidance to be derived from decided cases. In some cases, the answer may be clear . In others, inevitably , a finer judgment will be called for . 27. Finally , Lord Toulson considered how this approach applied to the facts of the case before the court. He began by identifying Mr Khan's functions or field of activities ([2016] AC 677, para 47): "In the present case it was Mr Khan's job to attend to customers and to respond to their inquiries. His conduct in answering the claimants request in a foul-mouthed way and ordering him to leave was inexcusable but within the 'field of activities' assigned to him." Lord Toulson then rejected the argument that the assault on the customer was' unconnected with Mr Khan's field of activities; an argument which had emphasised in particular the fact that Mr Khan had left the sales kiosk and followed the customer to his vehicle. In that regard, he said (ibid): "What happened thereafter was an unbroken sequence of events. It was argued by the respondent and accepted by the judge 'that there ceased to be any significant connection between Mr Khan's employment and his behaviour towards the claimant when he came out from behind the counter and followed the claimant onto the forecourt. I disagree for two reasons. First, I do not consider that it is right to regard him as having metaphorically taken off his uniform the moment he stepped from behind the counter . He was following up on what he had said to the…
Read the unabridged text and precedent citation network on Al Wakeelo Legal Research Platform.