The Supreme Court’s Limits On The Scope Of Vicarious Liability
09/19/2021
Over the past two decades, the doctrine of vicarious liability (where one party is held responsible for the actions of another) has considerably expanded. It has grown from simply applying to employment relationships to non-employment relationships (for example contractors) to misconduct.
The expansion of vicarious liability resulted in considerable confusion. However, in recent years, the Supreme Court has placed limits on how far the boundaries of vicarious liability can stretch. But before considering these cases, we must briefly discuss the test for vicarious liability laid down by the Supreme Court in 2012.
The test for vicarious liability
In Catholic Child Welfare Society and others v Various Claimants and The Institute of the Brothers of the Christian Schools [2012] UKSC 56, Lord Phillips stated that the criteria for establishing vicarious liability involved a synthesis of two stages: first, whether the relationship between the member and the Institute was capable of giving rise to vicarious liability and, second, an examination of the connection that linked the relationship between them with the member’s wrongful act or omission.
Lord Phillips also listed five “incidents” of employment relationships “that make it fair, just and reasonable to impose vicarious liability”. These are:
i. the employer is more able to compensate the victim (especially as they are likely to be insured);
ii. the wrongdoing usually arises from activity performed by an employee on behalf of an employer;
iii. the employee’s activity is likely to be part of the employer’s business activity;
iv. the employer created the risk by employing the person who committed the negligent act or omission to carry out tasks that gave rise to the risk;
v. employers generally have control of their employees.
Several years after the Christian School’s case, a jolt of fear was delivered to employers across the UK by the Court of Appeal’s decision in Wm Morrison Supermarkets plc v Various Claimants.
Employee held vicariously liable for data breach
In October 2018 the Court of Appeal surprised many legal commentators (some called the decision “bewildering ”) when it upheld a High Court verdict that meant employers could be held vicariously liable for their employees’ actions even if:
- they had taken all preventative measures available,
- bore no criminal responsibility,
- no financial loss was suffered by victims of the data breach, and
- the employee’s actions were designed to hurt the employer not the victims
The case in question, WM Morrison Supermarkets plc v Various Claimants UKSC 12, involved a trusted employee of Morrison’s Supermarket, Andrew Skelton, who held the position of a senior IT auditor. He enjoyed access to a large database of payroll information, which he leaked onto the dark web. The data contained information including the names, addresses, gender, dates of birth, telephone numbers, National Insurance numbers, bank account details and salary details relating to Morrison staff members.
Skelton attempted to frame a co-worker for the leak; however, he was jailed for eight years in 2015 after being found guilty at Bradford Crown Court of fraud, securing unauthorised access to computer material, and disclosing personal data.
The relevant legislation applicable to the case was the Data Protection Act (DPA) 1998. Had the case come under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, the outcome for Morrison’s may have been considerably worse.
It was for the Court to rule whether the supermarket chain was directly liable for the data breach under the DPA 1998 and also whether the corporation was vicariously liable for the actions of Skelton.
The High Court held that there was enough connection between the role Skelton had been employed for and his wrongful conduct to justify holding his employer vicariously liable.
The Court of Appeal upheld the decision. It ruled that if Parliaments intended to exclude vicarious liability, which is a substantial common law and equitable right, it would have expressly done so.
However, the Supreme Court unanimously held that the supermarket was not vicariously liable for the data breach, dashing employees’ compensation hopes.
Lord Reed concluded that employers could only be liable for an employee's actions if those actions were "closely connected" with their employment duties.
He said:
"In the present case, Skelton was not engaged in furthering Morrisons' business when he committed the wrongdoing in question. On the contrary, he was pursuing a personal vendetta, seeking revenge for the disciplinary proceedings a month earlier.
"In these circumstances, applying the established approach to cases of this kind, his employer is not vicariously liable."
Lord Reed concluded that whilst there was a close sequential link and an unbroken chain of causation connecting Skelton being able to access the affected employees’ personal data and being able to transfer that data to the file share, this was not enough to satisfy the second element of the Christian Schools test.
Regarding whether an organisation could be held liable for the actions of an independent contractor, this was considered in Barclays Bank plc v Various Claimants [2020] UKSC 13.
Independent contractors and vicarious liability
In early April 2020, the Supreme Court ruled on whether Barclays Bank was vicariously liable for sexual assaults supposedly committed between 1968 and circa 1984 by Dr Gordon Bates (deceased).
Dr Bates was appointed by the bank to carry out unchaperoned medical examinations on potential employees. He ran an independent private practice and Barclays paid him for each finalised report. At no stage was the doctor paid a retainer.
The group action for vicarious liability consisted of 126 Claimants, all of whom claimed Dr Bates sexually abused them. The High Court and the Court of Appeal found Barclays Bank vicariously liable for Dr Bate’s actions. However, the Supreme Court overturned these judgments, asserting that Part A of the two-stage test set out in Christian Schools was not satisfied because Dr Bates was plainly an independent contractor. Following a thorough discussion of previous case law, Lady Hale stated:
“the question therefore is, as it has always been, whether the tortfeasor is carrying on business on his own account or whether he is in a relationship akin to employment with the defendant.”
No test was provided for establishing whether a relationship akin to employment existed, instead Lady Hale stated that the nature of the relationship would need to be carefully examined to draw a conclusion one way or another.
Regarding Lord Philip’s five factors, Lady Hale stated that these would be helpful in doubtful cases, but not in situations “where it is clear that the tortfeasor is carrying on his own independent business.”
Conclusion
The decisions in WM Morrisons and Barclay’s Bank have provided much-needed clarity on the doctrine of vicarious liability. For employers, the defining and limiting of the scope of the principle will help them to create accurate risk assessments and develop adequate policies and procedures to protect their business, its stakeholders, and its customers.
While every effort has been made to ensure the accuracy of these court updates, these articles are intended as a general overview and not intended, and should not be used, as a substitute for taking legal advice in any specific situation. Neither Zurich Municipal, nor any member of the Zurich group of companies, will accept any responsibility for any actions taken or not taken on the basis of these article
