Data protection: employer not vicariously liable for employee's actions

The Supreme Court has ruled, in Wm Morrisons Supermarkets Plc v Various Claimants [2020] UKSC 12, that a company is not vicariously liable for the actions of a rogue employee who leaked employee data to a publicly available file-sharing website.

In 2015 a former Morrisons employee was found guilty of stealing and unlawfully sharing the personal data (including names, addresses, bank account details, salary and national insurance details) of almost 100,000 of Morrisons’ employees with members of the press and with data sharing websites. The Court of Appeal had ruled that Morrisons was vicariously liable for its employee’s actions but the Supreme Court has overturned that ruling. Vicarious liability was not established in this case as the wrongful conduct was not so closely connected with acts the employee was authorised to do that it may be regarded as done by the employee acting in the ordinary course of his employment.

For further information, see this post on our Data Notes blog.