Bradford 01274 350 800
Leeds 0113 849 4000
Huddersfield 01484 915 000

Welcome news for employers

Safeguarding from liability

Cases on vicarious liability for employers are, it seems, like buses.  No cases for months and then two decisions are handed down in one day…

In April, the Supreme Court dealt with this very issue issue for employers.  The first case concerned a data breach by an employee of Morrison's, the second allegations of sexual assault by a doctor retained by Barclays Bank to carry out medicals for its staff.

In each case, the Supreme Court found that the employer was not vicariously liable for the actions of the individuals concerned. However, there are important measures you must take as I will now explain.

Firstly, what is vicarious liability?

In employment law, vicarious liability is an employer's liability for the acts of its employees. In common law an employer is vicariously liable for the tortious acts of its employees if they are carried out "in the course of employment".

Let's explore the two cases.

WM Morrison Supermarkets plc v Various Claimants


  • A senior employee who was entrusted to transfer employee payroll data to Morrison’s auditors.
  • The employee held a grudge against Morrison as a result of previous disciplinary action taken against him.
  • He transferred the data to the auditors and made a second copy which he then released onto a public file-sharing website and to three newspapers anonymously.
  • The papers declined to publish the data but informed Morrison who reported the breach to the police.
  • The individual concerned was arrested, charged and convicted as a result of his actions
  • A number of individuals whose data was disclosed brought claims against Morrison for compensation for misuse of their data, breach of confidence and breach of Morrison’s statutory duty under the Data Protection Act 1998.

What happened next?

Morrison argued that it was not responsible for the disclosures made by the individual employee.  It argued that he had acted outside of his duties, at home, on personal IT equipment and on a non-working day.  However, the Court of Appeal originally found that he had been entrusted with the payroll data and his acts of sending the data to third parties was within the work which he was required to carry out as part of his duties.  The fact that he had acted as a result of a grudge against Morrison was not relevant.

The ruling

The Supreme Court, however, did not agree.  It held that there was not a sufficiently ‘close connection’ between the acts which the employee was authorised to carry out and the acts complained of so as to mean that his unlawful acts could be regarded as carried out by him ‘in the course of his employment’.  He was not acting so as to further the interests of his employer – indeed, he was pursuing a personal vendetta against them.  The mere fact that he had the opportunity to disclose the data simply because of his employment did not of itself mean that Morrison was vicariously liable for his acts.  Morrison was not therefore vicariously liable for the disclosure of the data.

Barclays Bank plc v Various Claimants


  • This case concerned a self-employed doctor who was engaged by Barclays to carry out medical assessments for prospective employees.
  • The doctor concerned died in 2009.  In 2015, a group action was brought by 126 claimants who alleged that the doctor had sexually assaulted them during the medical examinations, which were carried out at Barclays’ request.
  • The High Court and the Court of Appeal both found following a preliminary hearing that Barclays was vicariously liable for the actions of the doctor.

What happened next and what was the subsequent ruling?

Following an appeal to the Supreme Court, that decision was overturned.  They found that Barclays could only be held vicariously liable for the acts of the doctor if he was an employee, or in a relationship which was ‘sufficiently akin or analogous’ to employment.  In this case, the doctor was self-employed.  He had his own portfolio of work and was paid a fee for each report produced.  He did not receive a retainer from Barclays and could refuse any particular offer of work which was made.  He was clearly carrying on business on his own account and was not therefore in a relationship with Barclays akin to employment.  Barclays could not therefore be vicariously liable for his actions.

Important lessons

The decisions in both cases at the Court of Appeal were potentially concerning for employers faced with rogue employees or self-employed contractors, and these decisions of the Supreme Court will therefore come as welcome news.

Both cases represent a significant narrowing of the scope of vicarious liability for employers when compared to the decisions made in the lower courts.  However, employers must of course not be complacent and the Morrison case comes as a stark reminder of the need to ensure that data security is tight. All reasonable steps need to be taken to ensure that anyone with access to data is unable to commit such a breach.

The team and I will support you every step of the way to ensure you take the right steps to protect yourself. Call us on 0113 849 4000 or email and we will help you.

About the Author

Gemma Sherbourne

Legal Director

Gemma is an experienced employment lawyer, providing advice for a variety of clients from senior executives…

View Profile View all