Vicarious Liability – A clear picture emerges from the fog of previous confusion

Barclays

Facts

The late Dr Bates was a medical practitioner who was accused of sexually assaulting 126 claimants between 1968 and about 1984. The claimants were all applicants for jobs at Barclays who were required to pass a medical exam. Barclays arranged appointments for the applicants with Dr Bates at his home, who was required to complete a pro forma report. Barclays paid Dr Bates a fee for each report.

Barclays argued that Dr Bates was a contractor and that recent decisions including those of the Supreme Court did not expand the categories of relationships giving rise to vicarious liability to include contractors.

Conversely, the claimants argued that Barclays should be vicariously liable for the alleged sexual assaults committed by Dr Bates, suggesting that a multi-factorial approach was necessary to decide whether it is “fair, just and reasonable” to impose vicarious liability.

Expanding vicarious liability to persons ‘akin to employees’

The recent decisions of the Supreme Court, which both Barclays and the claimants relied upon, introduced a concept of a relationship being sufficiently “akin to employment” so as to make it fair and just to hold a quasi-employer vicariously liable.

In particular, the case of Christian Brothers, [2012] UKSC 56, provided that specific policy reasons could determine when it is fair, just and reasonable to impose vicarious liability on an employer. The lower Courts have often relied on these policy reasons to utilise this multi-factorial approach when determining whether to impose vicarious liability on an employer where it was unclear if an employment relationship existed.

The High Court and the Court of Appeal in Barclays followed the same approach. Indeed, the Court of Appeal found that using this multi-factorial approach replaced the need to decide if the  wrongdoer was an independent contractor.

Supreme Court’s reasoning

The Supreme Court  re-visited the recent decisions the parties were relying upon.  The Court determined that the previous decisions had been misunderstood and that, when analysed in detail and in the wider context, each decision reinforced the trite position that vicarious liability has not been extended to relationships in which one party uses the services of an independent contractor.

The Court highlighted that employment and relationships akin or analogous to employment should be distinguished from a relationship with an independent contractor and the case law preceding Barclays has not eroded this distinction. It is only where it is unclear whether the wrongdoer is an independent contractor that the multi-factorial approach set out in Christian Brothers could be considered to decide if a relationship is one “akin to employment”.

On the facts, the Supreme Court decided that as between Barclays and Dr Bates the relationship was with an independent contractor. The factors which contributed to this decision were that Dr Bates was not an employee of Barclays at any time, he was not paid a retainer, he was free to refuse an offered examination and he was in business on his own account with a portfolio of other patients and clients.

On that basis, Barclays was held not to be vicariously liable for Dr Bates’ actions.

Morrisons

Facts

Mr Skelton was employed in Morrisons’ internal audit team. As part of an external audit, Skelton was given access to employees’ payroll data. Following a verbal warning for an unrelated minor disciplinary matter, Skelton developed a personal vendetta against Morrisons and decided to copy the payroll data for almost 100,000 employees and publish it to a public file sharing website using his home computer. Mr Skelton was convicted of a number of offences and sentenced for 8 years imprisonment.

9,263 of Morrisons’ employees or former employees whose personal data was published by Skelton brought proceedings against Morrisons for breaches under the Data Protection Act 1998 (“DPA”) and a claim on the basis that Morrisons was vicariously liable for Skelton’s conduct.

Misunderstandings arising from Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11

The lower courts in Morrisons relied upon the judgement in Mohamud as effecting a change in the law of vicarious liability, namely that a connection exists between a relationship of employment and the wrongdoing if there is an “unbroken temporal or causal chain of events” and that the motives of the wrongdoer are irrelevant.

The Supreme Court in Morrisons asserted that this was a misunderstanding. The Court explained that, what the Supreme Court had meant in Mohamud was that the wrongdoer was acting throughout in the course of his employment and it was the course of employment which was “unbroken”. The Supreme Court also highlighted that in Mohamud it was important whether the wrongdoer was acting on his employer’s business or whether he was acting for personal reasons.

The Supreme Court reiterated that the courts have to decide if there was a connection between the employment relationship and the wrongdoing which would make it fair and proper to attribute vicarious liability to the employer. However, this connection cannot be determined by an individual judge’s sense of social justice. Instead, the courts must apply “orthodox common law reasoning” from previous cases.

Supreme Court’s decision

On that basis, the Court held that Morrisons was not vicariously liable for Skelton’s actions because the unlawful disclosure of the data was not sufficiently closely connected to what Skelton was authorised to do by Morrisons.  Skelton was not furthering the business of Morrisons when he committed the wrongdoing; on the contrary he was seeking to harm his employer.  There mere fact that Skelton’s job gave him the opportunity commit the unlawful conduct was not in itself sufficient to impose vicarious liability. 

The Data Protection Act

Although the Supreme Court did not have to rule on the DPA issues, it agreed with the Court of Appeal that vicarious liability can be imposed on the employer for an employee’s breaches of the DPA. Lord Reed applied normal principles of statutory interpretation and noted that the DPA is silent on vicarious liability.  The mere fact that the DPA establishes a fault-based liability for data controllers does not preclude employers being liable on a strict vicarious liability basis. 

The implications of these decisions

The Barclays decision reinforces the long established principle that a person cannot be held to be vicariously liable for the actions of a truly independent contractor. However, this decision also highlights that the courts have tools at their disposal to find, dependent on the precise factual matrix, a relationship sufficiently “akin to employment” which would result in vicarious liability being attributed to the employer.

On that basis, companies should be mindful that their workers, over and above their direct employees and who, objectively, could be viewed as their employees could cause the company to be liable for the worker’s actions.

The Morrisons decision highlights that actions taken by employees of a personal nature and not in the course of an employer’s business, are unlikely to lead to vicarious liability being imposed on employers. However, this will be decided on a case by case basis and all the facts of the matter will have to be considered.¹

These decisions should help provide a degree of clarity to companies in determining the extent of their liability for the acts of employees and service providers. Additionally, the Morrisons case helps to restore some much needed common sense when an employee acts for his own personal and vindictive reasons rather than for the company’s purposes. This means that an employer which suffers an incident, such as a cyber breach, resulting from the malicious act of an employee, is less likely to be deemed responsible to the victims, provided the company can demonstrate reasonable cyber security measures were taken.

These decisions will be welcome news to employers.

In both decisions, the Supreme Court used the vast majority of its judgments to correct previous misunderstandings of its decisions.  The reasoning in both decisions and from the same constitution of the Court, although focussing on the two different limbs of vicarious liability, can be seamlessly read as a whole. This suggests that the Supreme Court saw this as an opportune moment to address the various inconsistencies and concerns in the application of the law on vicarious liability. Corporates will be glad to see the Supreme Court ironing out the wrinkles in a way which provides much needed clarity to employers and does not extend the boundaries of vicarious liability into the burgeoning field of data breach group litigation.

The authors are grateful to Aleksandra Kucharska for her assistance in producing this article.