2022-02-02 15:43:00
In News exactly one year ago today, we reported on the Supreme Court decision in Various Claimants v Wm Morrison Supermarkets plc [2020] UKSC 12. An employee of the supermarket business had published the confidential information of numerous fellow employees who sought to hold Morrisons vicariously liable. The Supreme Court dismissed the claims.
The High Court has now considered the application of the Supreme Court’s decision in a health and social care setting.
In Ali v Luton Borough Council [2022] EWHC 132, the Claimant’s marriage had run into difficulties. There were two children and the marital problems led to the Defendant’s social services department becoming involved. The Claimant made a complaint to the police about the conduct of her husband and this led to a multi-agency referral by the police to the Council. A few weeks later, the Claimant began to suspect that information relating to her had been leaked. Her family and friends began asking her questions about why she had involved the police. When the Claimant asked about the source of their information, it emerged that her husband was saying that he had been told by an individual who worked for the Council whom he was seeing.
The Council instigated a data audit which revealed that an employee with whom the husband had a relationship had accessed the Claimant’s file held by the Council, including data of a highly sensitive nature. It also became apparent that the employee had provided the husband with pictures of the information and quotes of conversations held by Social Services. The husband had shown people these records. The employee was convicted of an offence under section 1 of the Computer Misuse Act 1990 and sentenced to 3 months’ imprisonment, suspended for 12 months, and ordered to carry out 150 hours of community service. The sentencing judge described the employee’s conduct as “deliberate, planned and goes against every professional code of conduct…and put the family at risk of harm.”
The Claimant brought a claim against Luton Borough Council on the basis that it was vicariously liable for the acts of its employee. The case came before Mr Richard Spearman QC, sitting as a Judge of the Queen’s Bench Division dismissed the claim. He found that the employee had been properly trained on GDPR and data protection, and there was nothing the Council could have done differently to have prevented what its employee did. In terms of vicarious liability, the Supreme Court had held in the Morrisons case that to establish liability “…the wrongful conduct must be so closely connected with the acts the employee was authorised to do that, for the purposes of the liability of the employer to third parties, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment.” The Claimant argued that the fundamental question was whether the wrongful act was sufficiently related to conduct authorised by the employer to justify the imposition of vicarious liability; and that the Council’s functions had afforded the employee to abuse her power. However, the judge rejected these submissions, holding that:
“Although [the employee] gained the opportunity to access and process data relating to the Claimant (and the children) by reason of the unrestricted access to the [Council’s software] system which she was required to be afforded in order to perform her role as a contact centre worker, it formed no part of any work which she was engaged by the Defendant to do to access or process those particular records.
In doing what she did, [the employee] was engaged solely in pursuing her own agenda, namely divulging information to the Claimant’s husband with whom she had some relationship. Further, that was to the detriment of the Claimant (and the children) whose safety and interests as users of the Defendant’s services it formed part of [the employee’s] core duty to further and protect.”
The employee had:
“not been tasked in any shape or form with either accessing or disseminating the information in question…[Her] wrongful conduct was not so closely connected with acts which she was authorised to do that, for the purposes of the Defendant’s liability to third parties, it can fairly and properly be regarded as done by her while acting in the ordinary course of her employment.”
Using terminology from early case law on vicarious liability, the judge held that this was a classic case of the employee being on a “frolic of her own”.