How responsible are employers for the actions of their staff?

The Court of Appeal has recently handed down judgments in two high-profile cases – Bellman v Northampton Recruitment Limited and Various v Wm Morrisons Supermarket PLC – both of which emphasise the extent of employers’ vicarious liability for the actions of their employees. With Christmas party season in full swing, Nick Tsatsas examines the cases and their implications.

The Facts

In Bellman, M was the managing director of Northampton Recruitment Ltd (NRL). In 2011, following NRL’s Christmas party, some of the guests, including M and B, another employee, went on to a hotel where some of the group were staying. NRL paid for the taxis to the hotel, and for some or most of the drinks that continued to be consumed. The conversation eventually turned to work matters, during the course of which M lost his temper. He began to lecture the employees present on how he owned the company and made all the decisions relating to it. B and M got into an argument, and M punched B twice. The second punch knocked B to the floor, fracturing his skull and rendering him unconscious. B suffered severe brain damage and is unlikely to work again. He brought a claim for over £1m worth of damages against NRL, on the basis that it was vicariously liable for M’s conduct.

In the Morrisons case, S was employed by Morrisons, the supermarket chain, as a senior IT internal auditor. As such, he had access to personal data about employees which was sensitive and confidential in nature. In July 2013, S was the subject of disciplinary action by Morrisons and, in an act of malicious revenge against Morrisons, he subsequently posted the personal details of almost 100,000 Morrisons employees on a file-sharing website. These actions led to S being arrested and charged with fraud, and offences under the Computer Misuse Act 1990 and the Data Protection Act 1998. In July 2015, he was convicted and sentenced to eight years in prison. The co-workers whose data had been disclosed made a group civil claim against Morrisons for compensation arguing, amongst other things, that Morrisons was vicariously liability for the actions of S.

The Law

Vicarious liability is a common law principle of strict (no-fault) liability for wrongs committed by another person; as Lord Sumption JSC put it in Bilta (UK) Ltd v Nazir (No 2) (3) :

“Vicarious liability does not involve any attribution of wrongdoing to the principal. It is merely a rule of law under which a principal may be held strictly liable for the wrongdoing of someone else.”

The public policy rationale for the imposition of vicarious liability was well summarised by Lord Phillips in Various claimants v Catholic Child Welfare Society and others(4), who said:

“There is no difficulty in identifying a number of policy reasons that usually make it fair, just and reasonable to impose vicarious liability on the employer when these criteria are satisfied: (i) the employer is more likely to have the means to compensate the victim than the employee and can be expected to have insured against that liability; (ii) the tort will have been committed as a result of activity being taken by the employee on behalf of the employer; (iii) the employee’s activity is likely to be part of the business activity of the employer; (iv) the employer, by employing the employee to carry on the activity will have created the risk of the tort committed by the employee; (v) the employee will, to a greater or lesser degree, have been under the control of the employer.”

Whether vicarious liability arises involves a two-stage test (both of which must be satisfied) :

• First, is there a relationship between the primary wrongdoer and the person alleged to be liable which is capable of giving rise to vicarious liability?

• Second, is the connection between (a) that relationship, and (b) the wrongful act or default of the primary wrongdoer, such as to make it just and reasonable to hold the person legally responsible to the claimant for the consequences of the wrongdoer’s conduct?

It is well established that an employment relationship can give rise to vicarious liability so, in such cases, the focus is on the second – “close connection” – stage of the test. This correct approach to this issue was most recently reconsidered and affirmed by the Supreme Court in the Mohamud(5) case. In that case, Lord Toulson held that the “close connection” test requires the court to consider two matters:

• The first question is what functions or “field of activities” had been entrusted by the employer to the employee, or in everyday language: what is the nature of the job? That question must be addressed broadly.

• The court must then decide whether there was sufficient connection between the position in which the employee was employed and the wrongful conduct so as to make it just and reasonable for there to be vicarious liability. This is to be approached applying the principle of social justice that those who carry on a business should bear the loss caused by risks associated with the business materialising, including the risk of an employee misusing his position, such a risk being “one of life’s unavoidable facts”. To that end, Lord Toulson noted that cases in which the necessary connection had been found all involved employees having used or misused the positions entrusted to them in a way which injured the claimant.

In Bellman, the Court of Appeal held that M was the directing mind and will of a relatively small company, whose authority, remit and “field of activities” were very wide. It also held that the drinks at the hotel, after the Christmas party, were not just an “impromptu” drinks party between work colleagues that might take place on any night after work. These drinks occurred on the same evening as the work event paid for and orchestrated by M. Moreover, M chose to wear his “metaphorical managing director’s hat” when lecturing his subordinates. In the Court’s view, the attack on B arose out of a misuse of the position entrusted to M as managing director. Accordingly, the Court held that there was sufficient connection between M’s job and the assault for his actions to be considered as “in the course of employment”, and thus to render NRL vicariously liable for those actions.

In the Morrisons case, the Court of Appeal upheld the High Court’s conclusion that when S received the data, he was acting in his capacity as an employee, and the fact that he chose to disclose the data, albeit in an unauthorised way, was still closely related to what he had been tasked to do – and thus “in the course of employment”. The Court addressed the unusual feature of the case – the fact that the aim of the wrongdoing was to harm Morrisons, and not for S to achieve some benefit for himself – by re-emphasising that the motive of the wrongdoer did not have any bearing on the employer’s possible vicarious liability.

Conclusion

Readers may be more sympathetic to the Court of Appeal’s ruling in Bellman than that in the Morrisons case. It may seem extraordinary that the supermarket should be liable for the actions of a rogue employee, acting maliciously. Perhaps not surprisingly, Morrisons has indicated that it intends to appeal the Court of Appeal’s decision.

While decisions in vicarious liability cases tend to be very fact-sensitive, so that the odd decision may seem inconsistent with others, Bellman and Morrisons continue the clear recent trend of cases where employers have been found to be vicariously liable for what may seem like the outrageous actions of employees. Consistent judicial rulings that an employee’s “field of activities” is to be considered widely have brought many acts and/or omissions within “the course of employment”. Thus, employers have been held liable for the actions of an employee who punched a customer (on the basis that the employee’s job involved assisting and interacting with customers) and for the actions of a warden at a care home who sexually abused children that he was meant to be caring for.

What should be of concern to employers is that the “no fault” nature of the vicarious liability doctrine makes it very difficult for them to proactively limit their potential liability for the actions of their employees. For example, it is doubtful whether an express instruction by an employer to its staff to behave appropriately at the staff Christmas party will protect that employer from being liable for any misbehaviour that does in fact occur.

Employers will also be alarmed that the Court of Appeal in the Morrisons case was unmoved by the fact that a finding of vicarious liability, in a case where there were 100,000 potential claimants, could place an enormous financial burden on the supermarket (and other employers in future cases) – even if the compensation due in respect of each individual claim might be quite small. The solution, the Court said, was for employers to insure against data breaches caused by system failures or by negligent employees, and/or against losses caused by dishonest and malicious employees. Of course, the cost of such insurance could be very considerable indeed, and there is every chance that insurers may introduce policy limits given the increased exposure resulting from cases such as these.

(1) [2018] EWCA Civ 2214

(2) [2018] EWCA Civ 2339

(3) [2015] UKSC 23

(4) [2012] UKSC 56

(5) See, for example, Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11