Next steps in vicarious liability – no liability for employee’s personal vendetta (UK)

Back in 2016 we commented on the increasing breadth of the vicarious liability concept as seen in a claim against supermarket chain Morrisons [here].  The store was held liable to a customer who was violently assaulted by one of its petrol station attendants in direct contravention of the criminal law, his training and all reasonable principles of putting the customer first.  Last year the High Court extended it even further in a decision which made difficult reading for employers and their insurers.

Various Claimants –v- William Morrisons Supermarket plc concerned the actions of one Andrew Skelton, formerly a senior IT analyst there but currently doing eight years for the conduct giving rise to this claim.  In mid-2013 Skelton received a formal warning which he considered undeserved.  He took this quite extraordinarily personally and some months later exacted his revenge on his employer.  He waited until very shortly before Morrisons’ annual financial reports were published and then posted online key personal and financial details of fractionally under 100,000 Morrisons’ employees.  At the same time he contacted the media as a concerned but anonymous citizen, complaining about the laxity in Morrisons’ systems implicit in that information now being publicly accessible.  About 5,500 of those employees sued Morrisons for that disclosure, claiming it to be either directly liable to them through breaches of the Data Protection Act or vicariously liable for Skelton’s conduct.

The High Court did not take long to dispose of the direct liability allegations.  It reviewed the precautions which the supermarket had taken both generally and in relation to the specific payroll data disclosed, and rejected the suggestion that Morrisons was at fault for leaving Skelton with access to this sort of data despite knowing him to be still resentful of the warning.  There was no criticism to be made of Morrisons’ handling of the matter once it was raised.

However, the vicarious liability question was more difficult.  Skelton had carried out the online disclosure and the communication to the newspapers in his own time, from his own home and on his own IT equipment.  How could this be said to be “in the course of his employment” as required to establish vicarious liability?  Moreover, Skelton’s actions were not just illegal but actually deliberately targeted at hurting Morrisons – how could the intended victim of the criminal offence end up being liable for it?

The High Court reviewed the available authorities, almost all of which concluded that employers could be vicariously liable for the criminal acts of their employees.  These included the fabulous Bernard –v- Attorney General of Jamaica in 2004 and the almost equally marvelous Brown –v- Robinson the same year.  In Bernard a policeman got into an argument with a member of the public about access to a telephone, which he resolved effectively but unlawfully by shooting him at point blank range.  The question of whether this was in the course of his employment was tilted firmly against the employer by the policeman later popping round to see the victim in hospital and there arresting him for obstruction.  In Brown another armed policeman was assaulted while managing a football crowd.  He chased his attacker, asking him if he really wanted the officer to shoot him.  Clearly finding the answer unsatisfactory in some respect, he did so anyway.  Again, this was seen as an unlawful way of doing something the policeman had been instructed to do (maintain order in the crowd) and so the employer was liable.

The High Court accepted that an employer might escape liability if it did no more unwittingly provide the equipment or premises for the criminal act, especially if the motive for that act arose wholly external to the employment relationship.  Here, however, the motive arose from the warning Skelton received from his employer and it was expressly part of his job to have access to, store and distribute payroll information.  That generated a connection to his work sufficiently close to establish Morrisons’ vicarious liability, it said.

The rather depressing lesson for employers was therefore not that you have to take even more technical measures against deliberate data breaches (or other criminal activities) or issue clearer instructions or more staff training.  Against such a wide application of the vicarious liability principles, none of those steps would be effective.  The sensible response was simply to insure yourself up to the eyeballs against claims of this sort.  The Judge made it clear that part of the vicarious liability equation will be who has the means to pay, and that will almost always be the employer.

However, though that particular advice remains valid, the Supreme Court has now overturned that decision. The point was in the end a simple one. Establishing vicarious liability required the claimants to show that Skelton was acting, even if misguidedly or criminally, in the furtherance of his employer’s business. If he were instead engaged solely in pursuing his own interests, off on a frolic of his own, then that condition was not satisfied. Here it was beyond sensible dispute that Skelton was not furthering Morrisons’ interests, even ineptly, but just the opposite – he was actively trying to damage them by “pursuing a personal vendetta, seeking vengeance” for the disciplinary warning months earlier. As a result, his conduct could not fairly be said to have been done in the ordinary course of his employment, so no vicarious liability arose.

Lessons for employers

• The change in law here is more significant in law than in practice. In law it has re-introduced (or strictly, re-emphasised) the importance of the offending employee’s motivation in determining the employer’s vicarious liability for it.


• However, in practice the decision does not allow employers to escape vicarious liability for any act by an employee just because it is malicious. A manager deliberately over-loading a subordinate through a personal grudge is still acting within the work-allocation part of his duties and so the employer would still be liable if the junior employee became ill as a result. Similarly, the Equality Act fixes the employer with liability for the discriminatory acts of its employees even if (in fact, particularly if) they are motivated by personal sentiment regarding a protected characteristic.


• The line between pursuing a grievance against a colleague on the one hand and a personal vendetta on the other may often seem a thin one in practice, especially where there is high emotion involved, and yet bringing a grievance is clearly a right integral to the employment relationship even if it is later rejected. Remember that it will only be in the most extreme cases that the Courts will allow this sort of separation of the employer’s interests from the personal purposes of the employee.


• And last, note the word “engaged solely in pursuing” his own interests – if there is some underlying connection to work in the employee’s actions, the fact that he may not be averse to some peripheral damage being caused to another party through them will not allow the employer to avoid liability under these principles.