""The law of vicarious liability is on the move." So stated Lord Phillips of Worth Matravers … The question raised by the current case, and by the parallel case of WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12, is how far that move can take it."
Lady Hale
In two judgments handed down in parallel on 1 April 2020, WM Morrisons Supermarkets plc v Various Claimants1 and Barclays Bank plc v Various Claimants2, the Supreme Court provided important clarification on the extent to which companies can be found to be vicariously liable under English law.
Each of the cases dealt with one of the two limbs of the test for vicarious liability under English law. Those two elements were helpfully summarised by Baroness Hale in the first paragraph of the Barclays judgment: "Two elements have to be shown before one person can be made vicariously liable for the torts committed by another. The first is a relationship between the two persons which makes it proper for the law to make the one pay for the fault of the other. Historically, … that was limited to the relationship between employer and employee… The second is the connection between that relationship and the tortfeasor's wrongdoing."
In both cases, the Supreme Court reinstated the orthodox legal position, which is a narrower application of vicarious liability under English law than had been allowed in the Court of Appeal decisions in both cases.
This case dealt with the question of whether Barclays Bank could be vicariously liable for alleged sexual assaults committed against 126 claimants by the late Dr Gordon Bates. Dr Bates had conducted medical examinations on a number of individuals who had been offered a job by Barclays, in order to prepare medical reports which were submitted to Barclays before the individuals started work at the bank. Dr Bates was not employed by Barclays, nor was he on a retainer; he was paid an individual sum for each medical report produced. However, Barclays arranged the appointments with Dr Bates, and told the applicants where and when to attend the medical examinations.
The question before the Supreme Court was whether Barclays could be found to be vicariously liable for the conduct of Mr Bates, notwithstanding that Mr Bates was not employed by Barclays. Barclays argued that the legal principle was, and had been since the 1840 decision in Quarman v Burnett, that a business was not liable for the actions of an independent contractor. However, the Claimants argued that recent Supreme Court decisions in Christian Brothers3, Cox v Ministry of Justice4 and Armes v Nottinghamshire County Council5 had changed the legal position, and that a range of incidents should now be considered when assessing whether an organisation would be liable for the behaviour of someone who is not an employee.
The Supreme Court found that the traditional legal position had not changed as a result of this trilogy of cases. The law remains that organisations can only be liable for the actions of employees, or individuals with a relationship akin to an employee relationship. The Court did acknowledge that in cases where the position is not clear, then the range of "incidents", which had first been identified by Lord Phillips in Christian Brothers, can be considered to assist in assessing whether a relationship is sufficiently analogous to employment for liability to be imposed. When assessing whether a relationship is akin to that of an employer-employee relationship, the key issue is to understand the details of that particular relationship. In the Barclays case, the Court found that Mr Bates' relationship with Barclays could not be viewed as analogous to an employment relationship, and therefore that Barclays could not be found to be vicariously liable for his actions.
In an interesting postscript, Lady Hale noted that recent developments meant that it was no longer always the case that an individual would be classified as an "employee" for all purposes: employment law, tax, social security and liability. Developments such as the "gig" economy have broken that link. However, the Court found that "it would be going too far down the road of tidiness" for the Court to align the statutory definition of "worker" with the concept of an employee, or employee relationship, for the purposes of vicarious liability.
This claim was a class action brought by Morrisons employees against the supermarket in relation to a data breach6. In 2015, Morrisons employee Andrew Skelton (a senior auditor), who held a grudge against the company following a disciplinary incident, had been found guilty of stealing the personal details of over 100,000 Morrisons employees and unlawfully sharing the details, by sending them to National newspapers.
The first question that the Supreme Court considered was whether or not Morrisons was vicariously liable for Mr Skelton's conduct. In this respect, the Court found that the Court of Appeal had misunderstood the principles governing vicarious liability and had incorrectly interpreted parts of Lord Toulson's judgment in the case of Mohamud7. Accordingly, the Supreme Court considered the question of Morrisons' liability afresh. The Court applied the general test laid down by Lord Nicholls in para 23 of Dubai Aluminium8, namely whether Skelton's disclosure of the data was so closely connected with acts he was authorised to do that, for the purposes of the liability of his employer to third parties, his wrongful disclosure may fairly and properly be regarded as done by him whilst acting in the course of his employment. In applying the "close connection" test, the Court found that it was necessary to have careful regard to the assistance provided by previous cases. Although the Court was not aware of any previous case law which had traversed the issue of whether an employer could be vicariously liable for the actions of an employee which were specifically designed to cause harm to the employer, the Court referred to the basic principle normally applied in cases where an employee is engaged in an independent personal venture, explained in Joel v Morison9.
The Supreme Court referred to the distinction drawn by Lord Nicholls in Dubai Aluminium, between cases where the employee is engaged, however misguidedly, in furthering his employer's business, and cases where the employee is engaged solely in pursuing his own interests: on a "frolic of his own". The Supreme Court found that Mr Skelton's wrongful conduct was not closely connected with the acts which he was authorised to do as part of his employment, but instead that his actions were specifically designed to cause harm to the employer. Accordingly, the Court found that Morrisons could not be held liable for Mr Skelton's wrongful conduct.
The second question put to the Court was whether the DPA 1998 excluded the imposition of vicarious liability. Having found that Morrisons could not be found vicariously liable in this case, the Court was not strictly required to consider this point. However, the Court considered that it would be helpful to provide its views on the arguments already made, and concluded that the DPA did not exclude the imposition of vicarious liability.
The cases provide helpful clarification of the law in this area, and will come as a welcome development for all organisations who were concerned by the implications of the lower court judgments for their own potential liability for the future actions of their employees.
The guidance provided in the Morrisons case, in which the Morrisons employee undertook the unlawful act at home using a mobile phone he had purchased personally, is also of increased relevance for companies now operating in the Covid-19 climate, where the majority of the workforce is working from home and, according to latest figures, 71% of UK companies have furloughed at least some staff10.
However, a note of caution – both cases are fact specific, and the potential liability of companies for the actions of their employees should continue to be assessed carefully by companies, in particular in the current climate.
The data protection implications of the case are considered further in this briefing by our Commercial team.
1 [2020]UKSC 12.
2 [2020] UKSC 13.
3 Full case name, Various Claimants v Catholic Child Welfare Society [2012] UKSC 56.
4 Cox v Ministry of Justice [2016] UKSC 10.
5 Armes v Nottinghamshire County Council [2017] UKSC 60.
6 The case was brought for breach of the Data Protection Act 1998 (now superseded by the DPA 2018), misuse of private information and breach of confidence.
7 [2016] AC 677.
8 [2013] 2 AC 366.
9 (1834) 6 C&P 501.
10 According to a report by the British Chamber of Commerce dated 22 April 2020.
