The general assumption is that employees who commit data breaches incur liabilities for their employers and not themselves. It is certainly the case when fines are imposed by the Information Commissioners Office. However what about when data subjects sue an organisation for data breaches? In the Supreme Court case of Morrisons (supermarket chain) v various claimants. This case involved a disgruntled employee, an internal auditor, who instead of sending payroll data to the supermarket's auditors, uploaded it on the internet, causing a data breach. In a group action, the Claimants succeeded in the High Court and the Court of Appeal for breach of statutory duty under the Data Protection Act 1998, misuse of private information and breach of confidence.
The Supreme Court engaged in a comprehensive review of the law on vicarious liability and held that Morrisons were not vicariously liable for the employee's act. The Court noted a fallacy in the previous decisions in this case; it is not enough to establish vicarious liability that the employee's act arose from a task 'closely related to what he was tasked to do'. There is vicarious liability where 'the employee is engaged, however misguidedly, in furthering his employer's business'. There is no vicarious liability where an employee is 'on a frolic of his own'. The judgment compared a Managing Director at a Christmas Party who punched an employee when illustrating who was in charge of the business (employer liable), with a police officer who left his post and accidentally shot a bystander when enraged after finding his girlfriend in a bar with another man (employer not liable). Where an act is one of 'personal vengeance', or an act that is in pursuit of private ends, an employee is not acting on his employer's business as in this case. Therefore, Morrisons were not vicariously liable for their employee's actions. This is an interesting case, because it really emphasises that the working assumption of vicarious liability can be displaced where mischievous employees are involved – out for their own gratification.
