WM Morrison Supermarkets plc v Various Claimants
Citations:  UKSC 12.
The appellant was a company running a chain of supermarkets. The respondents were its employees and former employees. One of the appellant’s employees leaked the respondents’ personal data from the appellant’s data bases onto the internet using his work computer. That employee had been subject to disciplinary proceedings and developed a grudge against the appellant. This grudge motivated his actions.
The respondents sued the appellant. They argued that the appellant was vicariously liable for the employee’s breach of data protection law. The appellant denied that they were vicariously liable, arguing that there was not a sufficiently close connection between their relationship with the employee and the illegal act. Alternatively, they argued that the Data Protection Act 2018 excluded vicarious liability for breach of statutory duty.
The Court of Appeal held that the appellant was liable, because the tort was within the field of the employee’s work activities and there was an unbroken causal connection between the employee’s job and the tort. They disregarded his motive as irrelevant. The appellant appealed.
- Was there a sufficiently close connection between the employee’s employment and the breach of data protection law?
- Does the Data Protection Act 2018 exclude vicarious liability?
The Supreme Court held in favour of the appellant. The Court of Appeal had not properly considered the relevant factors:
- The employee was not authorised or employed to make disclosures on the internet. Accordingly, the tort was not part of the field of his activities.
- While there was a temporal and causal connection between the employee’s job and the tort, this was not enough to establish a close connection.
- The employee’s motive was relevant. The employee was motivated by a purely personal grudge.
The Supreme Court considered that these factors meant that there was not a sufficiently close connection between the employment and the tort. The employee was engaged in a purely personal vendetta.
This Case is Authority For…
It is relevant to whether there is a close enough connection that there is an unbroken sequence of events leading from work activities to the tort. However, this does not refer to a purely causal connection between work activities and the tort. Instead, this refers to an unbroken connection between the tortfeasor’s capacity (as granted by their relationship with the employer) and the tort.
The fact that a job gives a person the opportunity or means to commit a tort is not sufficient to establish a close connection on its own.
The Supreme Court noted that the statement in Mohamud v Morrisons  UKSC 11 that the tortfeasor’s ‘motive was irrelevant’ was not making a general statement of principle. A tortfeasor’s motive is relevant to vicarious liability, if it indicates the tortfeasor was acting in a purely personal capacity. All the Supreme Court meant in Mohamud was that the precise reason the tortfeasor escalated to violence was irrelevant.
Obiter, the court noted that the Data Protection Act 2018 does not exclude vicarious liability.