No Vicarious Liability For Rogue Employee's Data Protection Breach

The Supreme Court judgment in the case of Morrison Supermarkets Plc v Various Claimants has been handed down and employers everywhere - and the insurers who underwrite their risks - can breathe a sigh of relief.

The Supreme Court has held that Morrisons was not vicariously liable for the actions of its former employee in wrongfully disclosing the payroll data of its entire workforce. The unanimous judgment concluded that the Court of Appeal had misunderstood the principles governing vicarious liability in a number of respects, although the Data Protection Act 1998 (DPA) did not exclude vicarious liability from a breach of that Act.

The decision applies to employees solely engaged in pursuing their own interests "on a frolic of their own". Employers may still be liable for data protection breaches where the employee is engaged, however misguidedly, in furthering their employer's business. Organisations may also be directly liable to individuals if they fail to