Keoghs Insight


Daniel Tyler

WM Morrisons v Various Claimants

News And Events01/04/2020

The Supreme Court has handed down judgment in WM Morrisons Supermarkets plc (Appellant) v Various Claimants (Respondent), finding for Morrisons. As with the parallel matter of Barclays Bank plc (Appellant) v Various Claimants (Respondents), the case concerns the scope of vicarious liability.  Daniel Tyler, Keoghs Associate, who was part of a team assisting Alastair Gillespie in the Barclays litigation, considers the Morrisons judgment and its ramifications.

The test for vicarious liability

To succeed in a claim against a defendant based on its vicarious liability for the wrongful actions of a primary tortfeasor, a claimant must satisfy a two-stage test.

  1. There must be a relationship between the defendant and the tortfeasor which is sufficient to trigger the doctrine of vicarious liability.
  1. The wrongful act committed by the tortfeasor must be sufficiently connected with that relationship to make the defendant vicariously liable for the tort. Or to follow the formulation of Lord Nicholls in Dubai Aluminium [2003] 2 AC 366, the wrongful conduct must be so closely connected with acts the employee was authorised to do that, for the purpose of the liability of the employer to third parties, the wrongful conduct may fairly and properly be regarded as done by him in the ordinary course of the employee's employment.

The Morrisons case concerns this second limb.

Factual background

Morrisons employed Andrew Skelton as a senior internal IT auditor. His job role involved speaking to fellow employees about their work and processes, and obtaining sight of relevant documents concerning them. In July 2013 he was given a formal verbal warning for using Morrisons' postal facilities for his private purposes.  This left Skelton with a grudge. He acted on it in November 2013 when he was asked to transfer payroll data for the Morrisons’ entire workforce to its external auditors KPMG. Whilst Skelton did as he was asked, he also made and kept a personal copy of the data with a view to making it public. In early 2014, Skelton uploaded a file containing the data to a filesharing website. Skelton later also sent the file anonymously to three UK newspapers on the pretence that he was a concerned member of the public who had seen it online. The newspapers alerted Morrisons, which had the data removed from the internet and informed the police. Skelton was soon arrested and was subsequently prosecuted and imprisoned.

The civil claims

A group of the affected employees sued Morrisons. Their claims were for breach of statutory duty under the Data Protection Act 1998 (‘the DPA’), misuse of private information, and breach of confidence. The employees contended that Morrisons was primarily liable under those heads of claim but, if not, that Morrisons was vicariously liable for Skelton’s wrongful acts.  At trial, the judge found that whilst Morrisons bore no primary responsibility, it was vicariously liable on each ground claimed. The judge also rejected the Morrisons’ argument that vicarious liability was inapplicable given the DPA’s content and its foundation in an EU Directive. Morrisons’ subsequent appeal to the Court of Appeal was dismissed. Morrisons appealed to the Supreme Court. The Supreme Court allowed the appeal with Lord Reed giving the judgment. 

The importance of the Mohamud case

Lord Reed observed that in finding Morrisons vicariously liable the High Court and Court of Appeal applied what they understood to be the reasoning of Lord Toulson in Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11 (‘Mohamud’).

Mohamud concerned whether the employer of a petrol station attendant was vicariously liable for his assault on a customer. The customer had gone into the sales kiosk and asked if some documents could be printed. The attendant refused the request and ordered the customer to leave, using racist and threatening language. The attendant proceeded to follow the customer back to his car, opened the door and ordered him never to come back, again using threatening language. When the customer told the attendant to close the door, the attendant assaulted him.

In Mohamud, the Supreme Court found the employer vicariously liable. In his judgment Lord Toulson summarised stage two of the vicarious liability test. The court had to consider two matters. The first was what functions or ‘field of activities’ had been entrusted to the employee or in other words the ‘the acts the…employee was authorised to do’. The second was ‘whether there was sufficient connection between the position in which he was employed and his wrongful conduct to make it right for the employer to be held liable under the principle of social justice which goes back to Holt CJ’. As Lord Reed emphasised, Lord Toulson was not suggesting any departure from Lord Nicholls’ approach in Dubai Aluminium.

In applying this test to the facts, Lord Toulson stated that the attendant’s job was to attend to customers and to respond to their enquiries. The attendant’s conduct in answering the customer’s request in a foul-mouthed way and ordering him to leave was inexcusable but within the ‘field of activities’ assigned to him. Moreover, what happened thereafter was ‘an unbroken sequence of events’ or ‘a seamless episode’. Lord Toulson added that the attendant’s motive was ‘irrelevant’.

In the current case the courts below treated a number of Lord Toulson’s comments as critical in particular:

1. His reference to ‘the principle of social justice which goes back to Holt CJ’;

2. His references to the connection between the employee’s conduct in that case and his employment (‘an unbroken sequence of events’, or ‘a seamless episode’), which they appear to have regarded as referring to an unbroken temporal or causal chain of events;

3. His statement that the attendant’s motive ‘is irrelevant’.

Supreme Court judgment

Lord Reed considered that the courts below had misunderstood the principles governing vicarious liability. Lord Reed made the following points:

1. Skelton’s disclosure of the data on the Internet did not form part of his functions or field of activities, in the sense in which those words were used by Lord Toulson in Mohamud: it was not an act which he was authorised to do.

2. The fact that the five factors listed by Lord Phillips in Various Claimants v Catholic Child Welfare Society [2013] 2 AC 1, para 35, were all present was nothing to the point. Those factors did not concern whether the wrongdoing in question was so connected with the employment that vicarious liability ought to be imposed, but with the distinct question whether, in the case of wrongdoing committed by someone who was not an employee, the relationship between the wrongdoer and the defendant was sufficiently akin to employment as to be one to which the doctrine of vicarious liability should apply.

3. Although there was a close temporal link and an unbroken chain of causation linking the provision of the data to Skelton for the authorised purpose of transferring it to KPMG and his disclosing it on the Internet, a temporal or causal connection does not in itself satisfy the close connection test. Lord Toulson’s comments in Mohamud that there was an ‘unbroken sequence of events’ and a ‘seamless episode’ referred to the capacity in which the employee had been purporting to act when the wrongful conduct took place, namely about his employer’s business.

 4. The reason why Skelton acted wrongfully was not irrelevant: on the contrary, whether he was acting on his employer’s business or for purely personal reasons was highly material. Lord Toulson’s comment in Mohamud about the attendant’s motive being ‘irrelevant’ should not be read out of context: he was addressing a point which the trial judge had mentioned, namely that the reasons why the attendant had become violent were unclear.

Consequently, whether Morrisons was vicariously liable for Skelton’s wrongdoing had to be considered afresh. Skelton was certainly authorised to collate and transmit payroll data to KPMG. But applying Lord Nicholls’ general test in Dubai Aluminium, Lord Reed found that his wrongful disclosure of the data on the internet was not so closely connected with that authorised task that, for the purposes of the liability of his employer to third parties, the wrongful disclosure may fairly and properly be regarded as made by him while acting in the ordinary course of his employment.  As Lord Reed emphasised, ‘Skelton was not engaged in furthering his employer’s business when he committed the wrongdoing in question. On the contrary, he was pursuing a personal vendetta, seeking vengeance for the disciplinary proceedings some months earlier.’ Accordingly, Morrisons was not vicariously liable for Skelton’s wrongdoing.

The other issue before the Court was whether the DPA excludes imposition of vicarious liability
for either statutory or common law wrongs. Although Lord Reed observed that it was not strictly necessary to consider this in light of his conclusion on the first issue, he stated that the Court found Morrisons’ argument that liability is excluded unpersuasive. 


This is a clear and welcome judgment. It underlines the fact that contrary to what has sometimes been suggested, the Mohamud case did not alter the second limb of the test for vicarious liability as set out in Dubai Aluminium  or for that matter in Lister v Hesley Hall Ltd [2001] UKHL 22; [2002] 1 AC 215. Practitioners should pay particular heed to paragraph 26 of Lord Reed’s judgment: ‘vicarious liability for wrongdoing by an employee…is decided by orthodox common law reasoning, generally based on the application to the case before the court of the principle set out by Lord Nicholls at para 23 of Dubai Aluminium, in the light of the guidance to be derived from decided cases. In some cases, the answer may be clear. In others, inevitably, a finer judgment will be called for.’

 For more information, please contact Daniel Tyler.