Case law: Employer held vicariously liable for publication of confidential data online in breach of data protection law
Employers should ensure employees are aware of any limits and restrictions on their activities, to reduce the risk of them acting wrongly in the course of their employment so that the employer becomes liable for their wrongful acts, a recent ruling makes clear.
A senior IT manager with a grudge against his employer published personal details of nearly 100,000 of his colleagues on the internet and sent them to three newspapers.
Around 5,500 of those employees claimed breach of statutory duty by the employer under UK data protection law, and for misuse of private information and breach of confidence.
The High Court found that the employee had been given access to the details as part of his job as it was needed for an audit, but he had carried out the breaches at home on his own PC, outside working hours, with the deliberate intention of harming his employer. The employer was not therefore directly liable for the breaches.
However, the Court held that the employer did have vicarious liability for the employee's wrongful actions as he had carried them out while 'acting in the course or scope of his employment'. His actions were sufficiently closely connected to his authorised duties.
The Court said the data had been entrusted to him, and he had received and copied it as part of his job. The breach was therefore part of a seamless and continuing sequence of events (even though copying the data and posting it to the Internet took place several months apart), creating a sufficiently close connection between his duties and his wrongful conduct.
However, the Court granted the employer the right to appeal, given that the employee had deliberately intended to harm his employer by committing the breach - so making the employer vicariously liable meant the Court had indirectly helped the employee achieve his aim.
Employers should ensure employees are aware of any limits and restrictions on their activities, to reduce the risk of them acting wrongly in the course of their employment and making employers liable for their conduct
Case ref: Various claimants v Wm Morrison Supermarket plc  EWHC3113
Authorised and Regulated by The Solicitors Regulation Authority. Authority number 591294.
For details of the professional rules governing the conduct of solicitors go to www.sra.org.uk/code-of-conduct.page