A second case about vicarious liability, WM Morrison Supermarkets PLC v Various Claimants, confirms that an employer was vicariously liable when an employee deliberately revealed confidential information relating to other employees on the internet in furtherance of a grudge against it. The Court of Appeal decided that the employee's motive was irrelevant to the question of vicarious liability.
The employee was a senior IT internal auditor who had access to highly confidential information in the course of his duties. After the employer took disciplinary action against him in relation to a relatively minor matter, he developed a grudge against it. He took a copy of the employer's payroll data and published it on the internet. A large number of employees brought claims against the employer for this misuse of their confidential information. Although the High Court found that the publication was not a breach of the employer's duties under the Data Protection Act 1998 (DPA), it was vicariously liable for the employee's misuse of private information and breach of confidence. The employer appealed.
The Court of Appeal upheld the finding of vicarious liability. Nothing in the DPA excluded the possibility of vicarious liability in these circumstances. The question was whether the usual tests for vicarious liability were met. Here the High Court had found that the employee's actions were within the field of activities assigned to him, and formed part of an unbroken chain of events that linked the wrongful actions and the employment. There was no exception to the principle that an employee's motive is irrelevant to the question of vicarious liability simply because the employee's motive in this case was to cause financial or reputational damage to the employer.