Is an employer vicariously liable when an employee commits a tort as a personal vendetta?
No, held the Supreme Court in Morrisons v Various Claimants, upholding the employer’s appeal.
The case involved a disgruntled employee, an internal auditor, who instead of sending payroll data to the supermarket’s auditors, uploaded it on the internet, causing a data breach.
In a group action, the Claimants succeeded in the High Court and the Court of Appeal for breach of statutory duty under the Data Protection Act 1998, misuse of private information and breach of confidence.
The Supreme Court engaged in a comprehensive review of the law on vicarious liability and held that Morrisons were not vicariously liable for the employee’s act. The Court noted a fallacy in the previous decisions in this case; it is not enough to establish vicarious liability that the employee’s act arose from a task ‘closely related to what he was tasked to do’.
There is vicarious liability where ‘the employee is engaged, however misguidedly, in furthering his employer’s business’. There is no vicarious liability – in the time-honoured phrase – where an employee is ‘on a frolic of his own’. The judgment compared a Managing Director at a Christmas Party who punched an employee when illustrating who was in charge of the business (employer liable), with a police officer who left his post and accidentally shot a bystander when enraged after finding his girlfriend in a bar with another man (employer not liable).
Where an act is one of ‘personal vengeance’, or an act that is in pursuit of private ends, an employee is not acting on his employer’s business as in this case. Therefore, Morrisons were not vicariously liable for their employee’s actions.
A separate point on whether the Data Protection Act 1998 excluded vicarious liability for the claims was considered although it was moot as the employer had succeeded, the Court indicated that there was no such exclusion regardless of the different legal tests.