This case serves as a reminder that an employer can be held liable for acts or omissions of their employees if it can be shown that those acts or omissions took place in the course of employment.
In Various Claimants v WM Morrisons Supermarkets Plc, the High Court found the supermarket chain vicariously liable for an employee’s disclosure of colleagues’ personal data. This is the first case of its kind since the introduction of the Data Protection Act 1998.
Mr Skelton, the employee, worked as a senior IT internal auditor and had access to confidential information about his fellow workers. In June 2013, Mr Skelton was subject to disciplinary action which he believed was unwarranted. In November 2013, he obtained payroll data to be passed to KPMG for external audit purposes. He downloaded this to a USB stick for KPMG but also made a personal copy. Just before Morrisons’ annual financial reports were announced in early 2014, Mr Skelton posted the personal information he had obtained on a file sharing website. He was then arrested and charged with a number of crimes including fraud and an offence under section 55 of the Data Protection Act. He was convicted and given an eight year prison sentence.
His colleagues, whose data had been disclosed, raised a group civil action against Morrisons, seeking redress for breach of the company’s statutory duty under section 4(4) of the DPA 1998, misuse of private information and breach of confidence.
The High Court agreed that Morrisons had no primary liability as they were not the data controller at the time of the breach. However, they were found to be vicariously liable as Mr Skelton’s wrongdoing was carried out in the course of his employment.
As Mr Skelton’s aim was to cause harm to Morrisons, the Court granted the company the right to appeal.
If you are an employer or employee facing difficulties in the workplace, please contact Paul Neilly or Hugh Grant by telephone (0141 552 3422) or email pdn@mitchells-roberton.co.uk or hjg@mitchells-roberton.co.uk.