The Supreme Court has ruled that Morrisons is not vicariously liable for an unlawful data breach committed by an ex-employee. The employee was acting purely in pursuit of his own vendetta against his employer. This took his actions outside the “field of activities” assigned to him.
The case arose from a data breach that saw thousands of Morrisons employees’ details posted online by Mr Skelton, a disgruntled ex-employee. The primary issue was whether there was a sufficient connection between Mr Skelton’s position and his wrongful conduct to make it right for Morrisons to be held vicariously liable.
The Supreme Court considered Mr Skelton’s motivation was relevant, disagreeing with the lower courts’ interpretation of previous case law. In fact, it was highly material whether Mr Skelton was acting in the ordinary course of his employment or for his own personal reasons. The Supreme Court found that Mr Skelton was acting purely in pursuit of his own vendetta against his employer, and his actions were outside the “field of activities” Morrisons had assigned to him. As a result, Morrisons was not vicariously liable for his actions.
The Supreme Court’s decision will allow employers to breathe a sigh of relief. The decision builds on previous case law to provide further guidance as to what should be considered within the ordinary course of employment. It ensures businesses will not be liable for acts of their employees that are wholly outside their authorised remit.
