Data protection: use of personal data for improper purpose

Where an employee of the appellant supermarket company had had a grudge against his employer and had unlawfully disclosed data concerning the respondent employees of the employer on the internet, the Court of Appeal, Civil Division, in finding that the employer had been liable for the employee’s unlawful acts, had misunderstood the principles governing vicarious liability. The Supreme Court, allowing the employer’s appeal, held that the employee’s wrongful conduct had not been so closely connected with acts which he had been authorised to do that, for the purposes of the employer’s liability to third parties, it could fairly and properly be regarded as done by him while acting in the ordinary course of his employment.

The appellant supermarket company (M) had employed an individual (S) as a senior auditor of its internal audit team. In his role, S had lawfully disclosed to M’s external auditors M’s payroll data relating to the whole of M’s workforce. However, because of previous disciplinary proceedings for which S had received a verbal warning, he had harboured a grudge against M and had copied the data and made it available on the internet via a file-sharing website. The respondents were employees of M who had had their data published by S. They issued the present proceedings against M for its alleged breach of statutory duty created by s 4(4) of the Data Protection Act 1998 (DPA 1998), misuse of private information and breach of confidence. The claims had also been brought on the basis that M had been vicariously liable for S’s conduct.

The trial judge held that M had been vicariously liable for S’s breach of statutory duty under the DPA 1998, his misuse of private information and his breach of his duty of confidence. That decision was upheld by the Court of Appeal, which found that the tortious acts of S in sending the respondents’ data to third parties had been within the field of activities that had been assigned to him by M, that the relevant facts had constituted a seamless and continuous sequence or unbroken chain of events, and that, whilst his motives had been to harm M, that motive had been irrelevant. M appealed.

Whether the Court of Appeal had erred in upholding the decision that M had been vicariously liable for S’s conduct.

In a case concerned with vicarious liability arising out of a relationship of employment, the court generally had to decide whether the wrongful conduct had been so closely connected with the acts that the employee had been authorised to do that, for the purposes of the liability of the employer, it might fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment (see [25] of the judgment).

In the present case, the Court of Appeal had misunderstood the principles governing vicarious liability in a number of relevant respects. First, the disclosure of the data on the internet had not formed part of S’s functions or field of activities, in the sense that it had not been an act which he had been authorised to do. Second, although there had been a close temporal link and an unbroken chain of causation linking the provision of the data to S for the purpose of transmitting it to the auditors and his disclosing it on the internet, a temporal or causal connection had not in itself satisfied the close connection test, and third, the reason why S had acted wrongfully had not been irrelevant; on the contrary, whether he had been acting on his employer’s business or for purely personal reasons had been highly material (see [31] of the judgment).

Accordingly, the question whether M had been vicariously liable for S’s wrongdoing had to be considered afresh applying the test of whether S’s disclosure of the data had been so closely connected with acts that he had been authorised to do that, for the purposes of the liability of his employer to third parties, his wrongful disclosure could fairly and properly be regarded as done by him while acting in the ordinary course of his employment (see [32] of the judgment).

It had been clear that S had not been engaged in furthering his employer’s business when he had committed the wrongdoing in question. On the contrary, he had been pursuing a personal vendetta, seeking vengeance for the disciplinary proceedings some months earlier. In those circumstances, S’s wrongful conduct had not been so closely connected with acts which he had been authorised to do that, for the purposes of M’s liability to third parties, it could fairly and properly be regarded as done by him while acting in the ordinary course of his employment (see [47] of the judgment).

In the circumstances, therefore, M could not be held liable for S’s conduct with the result that the appeal would be allowed (see [56] of the judgment).

Warren v Henlys Ltd [1948] 2 All ER 935 approved; Lister v Hesley Hall Ltd [2001] UKHL 22 applied; Dubai Aluminium Co Ltd v Salaam (Livingstone, third parties) [2002] UKHL 48 applied; Hartwell v A-G of the British Virgin Islands [2004] UKPC 12 considered; Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11 considered; Bellman v Northampton Recruitment Ltd [2018] EWCA Civ 2214 approved.

Decision of The Court of Appeal (Civil Division)  [2019] 2 All ER 579 Reversed.

Lord Pannick QC, Anya Proops QC, Rupert Paines and Gayatri Sarathy (instructed by DWF Law (LLP) (Manchester)) for M.

Jonathan Barnes and Victoria Jolliffe (instructed by JMW Solicitors LLP (Manchester)) for the respondents.

Peter Fuller - Barrister.