The question of whether a company should face liability for the actions of an employee, out of hours and away from the workplace, has recently been considered twice. First by the Court of Appeal in the context of a Christmas party in Bellman v Northampton Recruitment Ltd (2018), the judgment in which was handed down on 11 October 2018, and then in the context of a deliberate data breach by an employee in Wm Morrison Supermarkets plc v Various Claimants (2018) in which the judgment was handed down on 22 October 2018.

In Wm Morrison, an employee of the supermarket was passed personal data relating to almost 100,000 employees of the supermarket in the course of his employment. Whilst the data was passed to him for proper purposes, in addition to handling the data in accordance with his duties, he chose to download it and then, from his home and outside working hours, to post the data on the intranet and send it to three newspapers. The employee was arrested, charged and convicted of criminal offences, and the supermarket was pursued for damages for the misuse of personal data, breach of confidence and breach of statutory duty.

The Court of Appeal applied the two stage test set out in the Supreme Court's judgment in Mohamud v Wm Morrison Supermarkets plc (Insurance Advisor Alert March 2016) which involves identifying the nature of the wrongdoer's role and then evaluating whether there was sufficient connection between that role and the wrongful conduct to justify the employer being held liable for that conduct. Whilst the criminal actions of the employee were deliberate and occurred outside the workplace, the handling of the data was within the field of activities of his employment and his actions were sufficiently closely connected with his duties to see the supermarket vicariously liable for his actions.

In Bellman, the managing director, who had arranged the company's Christmas party and was viewed as the company's directing mind, assaulted an employee in the course of a disagreement when drinking after the party in a hotel, to which the managing director had arranged taxis for a number of employees.

The Claimant and a number of his colleagues were discussing company business, including concern that a new employee was being paid substantially more than others. The managing director started to lecture the group, lost his temper and punched the Claimant who fell backwards and suffered a serious head injury.

Whilst the incident occurred at an event attended voluntarily which was at a different location from the Christmas party, as it did in Wm Morrison above the Court of Appeal applied the two stage test set out in the Supreme Court's judgment in Mohamud. The Court found that the managing director's remit and authority were wide and that his lecturing of the group involved the exercise of his authority over the other employees. The assault constituted a misuse of that authority and, despite the time and place of the drinking session, there was a sufficient connection between his role and the assault to render the company vicariously liable for it.

The Court of Appeal emphasised that the facts of this case were unusual and that liability will not arise just because an argument between colleagues about work related matters leads to an assault even where one is considerably more senior than another.

While these decisions and other recent decisions demonstrate that the Courts are willing to find businesses and organisations responsible for the actions of their employees and contractors despite them occurring away from the workplace and outside working hours, care should be taken to consider the controls applied in these decisions when assessing whether vicarious liability might arise in a claim.

The recent developments in vicarious liability are discussed in our annual market conditions and trends report, published last month, which can be accessed here.