Vicarious liability – reining in the scope?

The Supreme Court has allowed two appeals concerning ‘vicarious liability’,  providing helpful clarity for claims of this kind and seemingly reining in the scope of such claims.

The appeals reverse successful claims made against two companies, WM Morrisons Supermarkets plc and Barclays Bank plc, alleging that the companies were liable for the actions of others.

A finding of vicarious liability requires a two-stage test to be satisfied:

• Was the relationship capable of giving rise to vicarious liability, i.e. one of employment or “akin to employment”?; and
• Was there a sufficiently close connection between the wrongdoing and the employment or employment-like relationship?

Self-employed contractors: Barclays Bank plc v Various Claimants[1]

For several years, Barclays’ recruitment procedures included a mandatory medical examination for prospective employees. One of the doctors performing these examinations was Dr Bates, a self-employed doctor who carried out a portfolio of similar work for a number of other companies.

It was alleged that Dr Bates committed sexual assaults against many Barclays’ employees and prospective employees between 1968 and 1984. In 2015, 126 alleged victims brought a claim against Barclays, claiming that the bank was vicariously liable for Dr Bates’s acts. Following Barclays’ appeal, the Supreme Court concluded that Barclays was not vicariously liable for his actions.

Although Barclays arranged the medical examinations with Dr Bates, he remained a self-employed doctor carrying on a business on his own account. He had a portfolio of clients, and Barclays paid a fee for each examination, rather than paying Dr Bates a retainer: he was free to accept or decline appointments that Barclays offered him. For these reasons, the Supreme Court determined that Dr Bates was not an employee of the bank, nor was there a relationship akin to employment. The Supreme Court compared Barclays’ relationship with Dr Bates to that of any of its other independent contractors, such as window cleaners or external auditors. For these reasons, they held that the first stage of the two-part test was not satisfied.

Data spill in aisle three: WM Morrisons Supermarkets plc v Various Claimants[2]

In 2014 an aggrieved employee of Morrisons, Andrew Skelton, leaked the personal data of nearly 100,000 colleagues online and sent copies to newspapers. The data, which included the national insurance numbers and bank details of Morrisons employees, was available to Mr Skelton as part of his role as a senior internal auditor. He had been tasked to transmit the data to Morrisons’ external auditors in 2013, however, he had kept a copy of the data and later published it online.

Morrisons took steps to have the data removed and informed the police, who arrested Mr Skelton. In the aftermath, they spent £2.26m to resolve the situation, which included informing employees, undertaking internal investigations and seeking to protect the identities of affected employees. Mr Skelton was convicted under the Data Protection Act 1998 (DPA) and Fraud Act 2006, ultimately receiving a prison sentence.

Thousands of affected employees brought a claim against Morrisons, claiming that the supermarket chain was directly liable, and vicariously liable, for Mr Skelton’s breach of the DPA, misuse of private information, and breach of confidence.

Whilst the direct claim against Morrisons failed, the claim for vicarious liability had been successful before Morrisons’ appeal to the Supreme Court. The Supreme Court ultimately decided that Morrisons was not vicariously liable for Mr Skelton’s wrongdoings. The second stage of the two-part test for vicarious liability had not been satisfied: there was no ‘close connection’ between Mr Skelton’s wrongdoing and the work he was asked to do by his employer. The data leak was a personal vendetta by Mr Skelton, and therefore his actions were not related to ‘furthering his employer’s business’. Whilst his employment gave him the opportunity to commit the data breach, that is not sufficient to find vicarious liability.

Why are these decisions important?

The decisions in Barclays and Morrisons bring welcome clarity to the application of the two-part test for vicarious liability.

The case of Barclays demonstrates the approach the Courts will take in deciding what it considers to be a relationship “akin to employment”, and the position of independent contractors in such scenarios. Whilst the decision may be surprising, given the mandatory nature of the medical examinations, it will be welcome news to organisations that engage the services of contractors.

Morrisons suggests a new level of commercial protection that could prevent organisations being penalised for the actions of ‘rogue employees’. It also sheds light on how the Courts will apply the law to data breaches, albeit serving as a warning to organisations to respond swiftly and comprehensively to safeguard against such threats. The case highlights the importance of a robust approach to data protection risk, including effective data and information policies. Organisations may wish to consider implementing (and stress-testing) procedures for responding to data breaches, and indeed other crises, which can have a devastating impact upon them.

Whilst these cases provide clarity of the approach taken by the Courts and extend the defences available, the law surrounding vicarious liability remains very fact-specific, and there may be other legal principles that lead to liability, e.g. breach of duty of care. As such, if you have any circumstances that may give rise to a claim against your organisation, then we would encourage you to seek specific legal advice.

Further information

If you have any questions or concerns around how these decisions may affect your organisation and any issues around liability for the actions of others, please contact Amy Callahan-Page or Sam Smith.

If you are concerned about employee misconduct, please contact Matthew Wort.

If you would like advice and support in relation to a data breach or more generally concerning your Data Protection obligations, please contact Clare Paterson.

[1] Barclays Bank plc v Various Claimants [2020] UKSC 13

[2] WM Morrisons Supermarkets plc v Various Claimants [2020] UKSC 12

• Share this