Employment Law Update - Vicarious liability for disclosure of employee data

27 November 2018

The Court of Appeal has upheld the High Court’s decision that an employer was vicariously liable for the deliberate disclosure of its workers’ personal data by a disgruntled employee.

Wm Morrison Supermarkets Plc v Various Claimants [2018] EWCA Civ 2339


In January 2018 the High Court ruled that Morrisons was vicariously liable for the deliberate disclosure of the personal data (via a file-sharing website) of a large number of its workers by a disgruntled individual, S, who had been employed as one of its internal auditors. The court was satisfied that there was a sufficient connection between the position in which S was employed and his wrongful conduct to justify holding Morrisons vicariously liable for his actions. S was convicted of various criminal offences under the Data Protection Act 1998 and sentenced to eight years’ imprisonment.

Morrisons appealed to the Court of Appeal, arguing that it should not be held vicariously liable for S’s actions.

Court of Appeal decision

The court has dismissed Morrisons’ appeal. The remedy of vicarious liability was neither expressly nor impliedly excluded under the provisions of the Data Protection Act 1998. It agreed with the High Court’s conclusion that S’s actions at work and the disclosure on the internet was a seamless and continuous sequence of events. The individual’s motivation, which in this case was to inflict damage on his employer rather than for any personal gain, was not relevant to the finding of vicarious liability.


The consequences of this decision for Morrisons are likely to be very costly, as it will be required to pay a significant level of damages to a very large number (5,518) of its employees. The decision also significantly broadens the scope for claims against employers, even where (as in this case) they have compliant data protection policies in place and even if they are subject to the vexatious actions of a rogue employee. The risk of reputational damage, as well as increased levels of fines under the GDPR, means that the consequences of the court’s decision are potentially very far reaching.

Morrisons has already indicated its intention to appeal this decision to the Supreme Court, so we are likely to have another ruling on the case in due course.

The content of this article is for general information only. For further information please contact Liz Stevens or a member of Birketts' Employment Law Team.

This article is from the November 2018 issue of Employment Law Update, our monthly newsletter on employment legislation and regulation. To download the latest issue, please visit the newsletter section of our website. Law covered as at November 2018.

To keep up-to-date with the latest news, legal updates and seminar information, please register and select the areas that are of interest to you.