“In the course of employment”: Vicariously liable for an employee’s wrongdoing

Understanding the concept of vicarious liability for employers

The law makes employers vicariously liable for various acts of their employees. There are good reasons for this; not least that it serves the interests of our society to provide a victim with a claim against a party with financial resources. 

It does not matter that the employer itself has done no wrong; that is the nature of vicarious liability. However, it is important that the acts of the employee, for which the employer is being held responsible, were carried out “in the course of employment.” Otherwise, the employer is not vicariously liable.

The impact of the Morrisons case on vicarious liability

This was one of many issues dealt with in the well-publicised case of Various Claimants v William Morrisons Supermarkets PLC, where a former employee of Morrisons unlawfully published, on a file sharing website, a file containing personal information of almost 100,000 employees of Morrisons. Of these, over 5,500 employees made claims against Morrisons claiming breaches of the Data Protection Act and of common law duties.

The case is an extreme reminder of the potential impact of employees’ actions and the potential liabilities that employers may face.

Understandably, Morrisons argued that the acts of the employee could not be regarded as “in the course of employment.” The acts were criminal; they were designed to harm the employer. How could they, therefore, be regarded as acts “in the course of employment?”

Morrisons lost that argument, the court deciding that there was a sufficient connection between the role that the employee had with Morrisons and his wrongful acts. The employee had been employed in a senior IT position and, as part of his role; he was entrusted with large amounts of personal data. The fact that Morrisons could not have foreseen that the employee would commit a criminal act with this data and that it had not broken any data protection principles, did not absolve Morrisons from vicarious liability for the employee’s acts.

A much older case, Jones v Tower Boot Co Limited, considered vicarious liability in the context of discrimination. The claimant was discriminated against on grounds of his race. He was physically assaulted and verbally abused. It was an extreme case. The employer argued that the acts of the discriminating employees were not done in the course of their employment as they were not modes of carrying out authorised tasks. As such the employer should not be liable. The Court of Appeal recognised that if the employer’s argument succeeded, then the more heinous the acts, the less likely a victim would have of obtaining a remedy. In its decision, it made clear that the issue of vicarious liability in a statutory discrimination context did not need to be interpreted in the same way as vicarious liability is considered in other (common law) jurisdictions. In effect, a wider interpretation of “in the course of employment” was expected in a discriminatory context.

The Morrisons case is the most recent indication that the issue of vicarious liability in a discriminatory context may have been paving the way. For example, between the Jones case and last year’s Morrisons decision we have seen a number of civil cases involving sexual and/or physical abuse in which employers have been vicariously liable for the acts of their employees.

Strategies for mitigating risk of vicarious liability for employers

How should you as employers deal with this potentially increasing risk of being vicariously liable for the acts of your employees?

1. Insure, where that is economically viable. Many scenarios for which employers are vicariously liable for the acts of employees will be covered by employers’ liability, public liability or professional indemnity insurance. Some employees will also be insured against findings of discrimination. A review of insurances though may well prove worthwhile.
2. Train and educate. There is a defence available to employers in relation to a number of statutory employment claims – particularly discrimination and public interest disclosures. Where employers take “all reasonable steps” to prevent employees treating other employees less favourably for unlawful discriminatory reasons.  Having regard to the public policy reasons behind vicarious liability, Employment Tribunals do not allow employers to rely on this statutory defence very readily. However, some employers have successfully relied on the defence and it is perhaps surprising that more employers do not put themselves in a position which enables reliance on the defence.
3. Taking reasonable steps to guard against the actions of “rogue” employees start with robust recruitment processes. It is surprising that employees do “slip through the net” at the recruitment stage. Make sure CVs are accurate and that references are taken up.  
4. Be vigilant with security measures. The Morrisons decision is particularly (albeit coincidentally) timely in that it involves data breaches. It helps to emphasise the need for organisations to properly prepare for GDPR and to build in security measures which, as far as possible, prevent this sort of illegal disclosure.  Of course, Morrisons built in appropriate security arrangements and yet were still found liable. However, the position could have been much worse for Morrisons and the measures taken by them will almost certainly have reduced by a considerable extent, the potential harm and liabilities incurred. It is important to note that Morrisons may well appeal this decision to a higher court.