## Facts

- In 2014, Andrew Skelton, a senior internal auditor at Morrisons, leaked payroll data of approximately 100,000 employees.
- Skelton had previously been disciplined by Morrisons for misuse of company systems for personal purposes.
- In retaliation, Skelton copied payroll data onto a personal USB drive and uploaded it to a file-sharing website, also disseminating the data to newspapers.
- The leaked data caused significant distress to affected employees, who brought claims against Morrisons for breach of statutory duty, misuse of private information, and breach of confidence.
- The claimants argued Morrisons was vicariously liable for Skelton’s actions as he accessed the data in the course of his employment.
- Morrisons contended Skelton’s actions were motivated by personal malice and were unrelated to his employment duties.

## Issues

1. Whether there was a sufficiently close connection between Skelton’s wrongful conduct and his employment to impose vicarious liability on Morrisons.
2. Whether vicarious liability applies where an employee’s wrongful act is motivated by personal malice rather than in furtherance of the employer’s business.
3. Whether imposing vicarious liability on Morrisons in these circumstances would be fair, just, and reasonable.

## Decision

- The Supreme Court held that Morrisons was not vicariously liable for Skelton’s deliberate data breach.
- The Court found Skelton’s actions were not carried out in furtherance of Morrisons’ business but were driven by personal animosity.
- It was determined that vicarious liability does not extend to acts done for purely personal reasons, even if facilitated by employment.
- The judgment reversed the Court of Appeal’s finding of vicarious liability against Morrisons.

## Legal Principles

- Vicarious liability requires a sufficiently close connection between the employee’s wrongful conduct and their employment duties.
- The motivation for the act, particularly where it is a personal vendetta, is relevant in assessing liability.
- The “close connection” test, as established in Lister v Hesley Hall Ltd [2001] UKHL 22, is central to determining liability.
- Employers are not generally liable for actions of employees undertaken solely for personal reasons and not in furtherance of the employer’s business.

## Conclusion

The Supreme Court clarified that employers are not vicariously liable for employees’ intentional data breaches motivated by personal animosity and not performed in furtherance of the employer’s business, defining the limits of vicarious liability in the context of employee misconduct involving sensitive data.


WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12