The UK Supreme Court issued two decisions on vicarious liability on 1 April which will be a relief in these difficult days to employers and business owners. The cases considered the circumstances where an employer will be vicariously liable, i.e. legally and financially responsible for the acts of another person, usually their employee.

Employee’s actions

In WM Morrison Supermarkets plc v Various Claimants, an employee purposely disclosed payroll data of Morrisons’ employees online and notified three newspapers of the same in retaliation for receiving a disciplinary sanction for unconnected misconduct some months previously. Approximately 10,000 employees took legal action against Morrisons, claiming a breach of confidence, misuse of private information and a breach of Section 4(4) of the Data Protection Act (DPA). Morrisons defended the action on the basis that they were not vicariously liable for the employee’s actions in the circumstances.

At first instance, and in the Court of Appeal, the judges disagreed with Morrisons' argument, finding in favour of the Claimants. They decided that the employee had the payroll data by virtue of their role with Morrisons, and so his disclosure to third parties was “within the field of activities assigned to him by Morrisons”. In their view, there was a seamless and continuous sequence or unbroken chain of events from employer to employee conduct. The fact that the motivation for the breach was malicious and intended to do harm to Morrisons was irrelevant in their minds.

The questions for the Supreme Court were whether Morrisons were in fact vicariously liable and, if so, whether the DPA excludes the imposition of vicarious liability for the claims raised. Considering the law, they found that the Court of Appeal misunderstood the “close connection” principles of vicarious liability and were mistaken in considering the motivation behind the breach as irrelevant. Drawing from well-established principles in Joel v Morison and Dubai Aluminium Co Ltd v Salaam, the Supreme Court differentiated between an employee engaged in furthering the employer’s business, however misguidedly, and an employee “engaging solely in pursuing his own interests: on a frolic of his own”. They decided that “it is abundantly clear that [the employee in this instance] was not engaged in furthering his employer’s business… on the contrary he was pursuing a personal vendetta”. Accordingly, his wrongful conduct was not so closely connected with acts which he was authorised to do and so Morrisons were not vicariously liable for these.

As to whether the DPA excluded liability, the Supreme Court found against Morrisons, albeit this was not a necessary part of their decision, standing their decision in Morrisons’ favour on the primary question. Imposing statutory liability under the DPA on the employee as the “data controller” could co-exist with the common law principle of vicarious liability. 

Actions of a third party

The case of Barclays Bank plc v Various Claimants considered an employer’s responsibility for self-employed contractors and their interactions with employees. Here, the Claimants suffered alleged sexual assaults by a self-employed doctor engaged to carry out medical examinations at Barclays’ request. Again, the Court of Appeal found in favour of the Claimants and this was overturned by the Supreme Court.

The basis for this decision lay in the relationship between the doctor and Barclays. The Supreme Court found that, for vicarious liability to apply, the relationship between the two persons – here, the doctor and Barclays – must be one “which makes it proper for the law to make one pay for the fault of another”. They noted that the key question is whether the person who committed the conduct is carrying on a business on their own account or whether the relationship is akin to the employment relationship. Relying on five criteria set out in Various Claimants v Catholic Child Welfare Society, the Court found that the doctor was in business on his own account, with a portfolio of patients and an ability to accept or refuse work from Barclays. Because of this, Barclays were not vicariously liable for any alleged assaults which took place when engaged by Barclays.


The two decisions bring clarity and some relief to employers who were facing increasing responsibility and litigation for actions of rogue employees and contractors. The Supreme Court decisions have reiterated that for an employer to be vicariously liable a clear link is required, both in the relationship between the parties and in the connection between that relationship and the wrongdoing.