WM MORRISON Supermarkets Plc. v Various Claimants [2020] UKSC 12, [2020] 2 W.L.R. 941 has somewhat narrowed the scope of vicarious liability. It was handed down alongside Barclays Bank v Various Claimants [2020] UKSC 13 (on which, see Richard Buxton, “Vicarious Liability in the Twenty-first Century” [2020] 97(2) C.L.J. 217). While Barclays concerned the first stage of the vicarious liability enquiry, whether or not the relationship between tortfeasor and defendant is one that will trigger the doctrine, the present case addresses the second: whether or not a sufficient connection exists between the wrongdoing and the relationship. Lord Reed, delivering the court's judgment, said the appeal “provide[d]…an opportunity to address the misunderstandings which have arisen since … Mohamud v WM Morrison Supermarkets [[2016] A.C. 677]” (at [1]). There is also an important point about the Data Protection Act 1998 (‘DPA’).
Morrisons was sued by several thousand employees/former employees when personal information was maliciously published on the Internet by another employee, Mr. Skelton. Skelton had been entrusted with payroll data to enable transmission to external auditors but had copied and published it in order to harm his employer. The claimants argued that Morrisons was liable for breach of a statutory duty under the DPA, misuse of private information and breach of confidence. Morrisons was also said to be vicariously liable.
The trial judge, Langstaff J., rejected the claims of primary liability but held Morrisons vicariously liable for all wrongs. Morrisons’ appeal was dismissed. Both the trial judge and Court of Appeal treated as important that disclosure was the essence of Skelton's designated task. Importance was also placed on the “seamless and continuous sequence” and “unbroken chain” of events (wording similar to Lord Toulson J.S.C.'s reasoning in Mohamud, at [47]). It was held by both courts that motive was irrelevant.
The questions for the Supreme Court were: (1) whether or not Morrisons was vicariously liable, and (2) if so, whether or not the DPA excluded vicarious liability for breach of the relevant obligations.
The Supreme Court allowed the appeal and found Morrisons not liable. It said the judge and Court of Appeal had misunderstood the principles governing vicarious liability in several ways (at [31]). The question of vicarious liability was thus to be considered afresh. As to the second issue, it was held that the statutory scheme was not inconsistent with the imposition of vicarious liability: the DPA is silent about the employer's position, precluding inconsistency (at [54]).
The first part of the judgment addresses what Lord Reed described as a misunderstanding of Lord Toulson's reasoning in Mohamud (at [16]–[30]). The courts below, it was said, had treated as critical: (1) his reference to the need for a sufficient connection to justify liability “under the principle of social justice which goes back to Holt CJ” (Mohamud, at [45]), (2) the comments understood as referring to the existence of an unbroken temporal or causal chain of events, and (3) the assertion that motive was irrelevant. It was acknowledged that, if correct, this approach would be a departure from existing law (at [16]). The court explained, however, that Lord Toulson was not suggesting any departure from Lister [v Hesley Hall [2002] 1 A.C. 215] and Dubai Aluminium [v Salaam [2003] 2 A.C. 366]” (at [26]). The relevant approach had been “expressly put in the simplest terms” by Lord Toulson: (1) identifying the “field of activities” and (2) deciding if a “sufficient connection” existed which would make it right for the employer to be held liable. This approach had been more fully stated by Lord Nicholls in Dubai Aluminium (at [23]): “the court … has to decide whether the wrongful conduct was so closely connected with acts the employee was authorised to do that … it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment” (at [25]). This was the approach endorsed in Mohamud, and several other decisions, and was authoritative (at [25]).
The court elaborated on the content of the second stage. Although there was a close temporal link and “unbroken chain of causation” between the data provision and Skelton's disclosure, this was insufficient to satisfy the “close connection” test (at [31]). A temporal and causal connection, and liability being “right” as a matter of social justice, will not be sufficient (at [26]). The court confirmed the need to identify, and derive assistance from, factors or principles in decided cases which point towards or away from vicarious liability (at [24], [26]). Further, it was said that Lord Toulson's comments in Mohamud – “unbroken sequence”, “seamless episode” – were not directed towards the temporal or causal connection between events, but towards the employee's capacity in acting: he was explaining why the employee had indeed been acting in pursuit of his employer's business (at [28]).
A two-step approach was confirmed as correct and applied. Lord Reed started by identifying the acts Skelton was authorised to do. His task was collating and transmitting data to auditors (at [33]). The second step is the “close connection” question, using the Dubai Aluminium test. It was the data provision that enabled him to make the copies used for disclosure (at [34]). However, the court added that “[c]learly, the mere fact that Skelton's employment gave him the opportunity to commit the wrongful act would not be sufficient” (at [35]). Lister was cited for this proposition. This is a welcome confirmation, as Mohamud appeared to leave little room for the “mere opportunity” principle (see P. Morgan, “Certainty in Vicarious Liability: A Quest for a Chimaera?” [2016] 75(2) C.L.J. 202). Without such a principle even the most outrageous conduct might result in employer liability. It was said that the courts below were wrong to see as important that Skelton's disclosure was closely related to his assigned task. Instead, the Supreme Court emphasised the need to have regard to analogous case law, and, drawing on this, placed greatest importance on whether or not the employee was furthering the employer's interests or their own (at [35]–[47]).
The basic principle was said to be that no liability would arise where the employee was on an “independent personal venture”, or a “frolic of his own”: at [37], quoting Parke B. in Joel v Morrison (1834) 172 E.R. 1338. The court looked to existing case law, particularly Attorney General of the British Virgin Islands v Hartwell [2004] UKPC 12, [2004] 1 W.L.R. 1273 (at [39]–[40]). There, a police officer had left his post, gone to a bar and shot his partner in a jealous rage with the revolver provided in the course of his duties. The factors creating the connection between the wrongdoing and authorised acts in Hartwell (use of the police revolver; shooting within his jurisdiction), “which might be thought to bear a close analogy to those relied on in the present case”, were insufficient for vicarious liability (at [40]). The court stressed the importance of the fact that the officer was acting “in pursuit of his own private ends” (at [44]); he had put aside his role. Bellman v Northampton Recruitment Ltd. ([2018] EWCA Civ 2214), in which the employer was held vicariously liable, was discussed with approval; the employee there had been asserting authority over subordinates and thus purporting to act in his employer's interests. Skelton was not so engaged – he was pursuing a personal vendetta.
This decision clarifies how courts are to treat personal motives of employees. In asserting that motive is irrelevant Lord Toulson, the court said, had been addressing a different point– namely, that the reasons why the employee in Mohamud had become violent were unclear. Having already reached the conclusion that he was going (wrongly) about his employer's business, the reason for his anger “could not make a material difference” (at [30]). The take-away message is that motive is relevant, insofar as it informs whether or not the employee is acting “on their employer's business”. This decision suggests that this question will be more pertinent than any closeness of the wrongful conduct to the “field of activities”.
Further questions arise. If motive is indeed relevant, and can take conduct beyond the reach of vicarious liability when an employee, motivated by personal reasons, “takes off their employee hat”, how does this square with previous case law imposing vicarious liability? Perhaps in Mohamud, where a petrol station attendant responded to a customer's request with racial abuse before ordering him from the premises and assaulting him at his car, it is just possible that there was a dual motive – personal racism and removal of the victim from the business premises (though this seems a stretch). It is more convincing that the employee in Bellman, in assaulting a subordinate at a hotel after the staff Christmas party following a challenge over a business-related decision, was acting in pursuit of the employer's interests. However, as the Court of Appeal had noted (at [76]), the motive for the tortious conduct in Lister, where the warden of a boarding home sexually abused children in his care, was clearly personal: sexual gratification. In other cases, theft or greed have been the clear motive. This problem, though raised by the Court of Appeal, was not addressed by the Supreme Court. It was suggested that sexual abuse cases ought to be left to one side, as “a more tailored version of the close connection test is applied” to those (at [36]). Is there now a bifurcation in approach between sexual abuse and non-sexual abuse cases?
Aspects of this decision are welcome. Where Mohamud involved a wide application of the “close connection” test, Morrison is likely to have a restraining effect. It also moves us some steps further towards clarity in the application of this second stage enquiry: motive is relevant, and if wrongdoing is motivated by personal vengeance vicarious liability is unlikely. However, it also raises new questions that will need answers. One is when direct liability might be imposed upon employers where they fail sufficiently to protect their employees against the abuse of their personal data by other employees. As to when vicarious liability will be imposed, clarity remains at large.
