Key employment law cases: April 2020

Morrisons not vicariously liable for a rogue employee’s data leak

WM Morrisons Supermarkets plc v Various Claimants – Supreme Court (6/7 November 2019, published 01 April 2020

In a judgment that will provide considerable relief to employers, the Supreme Court (overturning the Court of Appeal’s October 2018 decision) held that Morrisons was not vicariously liable for an employee’s deliberate payroll data leak. The judgment shows that the Courts will take a common-sense approach when confronted with a data breach that has been caused maliciously outside of the course of the activities that the employee has been authorised to carry out.

The case involved a disgruntled employee, an internal auditor, who instead of sending payroll data to the supermarket's auditors, uploaded it on the internet, causing a data breach. In a group action, the Claimants succeeded in the High Court and the Court of Appeal for breach of statutory duty under the Data Protection Act 1998, misuse of private information and breach of confidence.

The Supreme Court engaged in a comprehensive review of the law on vicarious liability and held that Morrisons was not vicariously liable for the employee's act.

The Court noted a fallacy in the previous decisions in this case; it is not enough to establish vicarious liability that the employee's act arose from a task 'closely related to what he was tasked to do'. There is vicarious liability where 'the employee is engaged, however misguidedly, in furthering his employer's business'. There is no vicarious liability - in the time-honoured phrase - where an employee is 'on a frolic of his own'. Therefore, Morrisons was not vicariously liable for their employee's actions.

Although the Supreme Court found that Morrisons was not as a matter of fact vicariously liable for Mr Skelton’s data breach, it then went on to consider whether vicarious liability is excluded by the DPA. The Supreme Court held that the principle of vicarious liability applies to the statutory data protection regime and the common law wrong of breach of confidence and misuse of private information.

Employers should continue to take care to ensure that they comply with their security obligations under the GDPR and the DPA; if there is a failing on the part of the employer that exposes personal data (even if that failing is then maliciously exploited by an employee), the employer will still be directly liable. This judgment does not in any way diminish the importance of ensuring that rigorous controls are in place over any personal data that is being processed on behalf of the employer.

Employers should also take note of the Court’s finding that the DPA does not exclude vicarious liability for breaches of the DPA/misuse of information/breach of confidence by data controllers under their employment; there is no blanket exclusion for vicarious liability. Hence the vetting of employees with access to personal data, and the constant review of the nature and scope of the data to which they have access, remains paramount.

Barclays not vicariously liable for acts of a doctor engaged by the bank to carry out medical examinations

Barclays Bank plc v Various Claimants – Supreme Court (28 November 2019, published 01 April 2020)

Barclays was held not to be vicariously liable for the acts of a doctor engaged to examine its staff. A claim was brought by 126 claimants against Barclays Bank plc, stating that the bank was vicariously liable for sexual assaults committed against them by a Dr Bates during medical examinations between 1968 and 1984. Job applicants were required to pass a medical examination to secure their role. The Supreme Court held that the doctor was not an employee of the bank, nor in a relationship akin to employment; rather, he was an independent contractor. He was in business on his own account. Relevant facts included:

• He did work for Barclays, amongst other clients and patients.
• Barclays made the arrangements for the medical examinations and chose the questions to be answered.
• He was not paid a retainer, which might have obliged him to accept a certain number of referrals from Barclays.
• He was paid a fee for each report and was free to refuse to conduct an offered examination.
• He was thought to have his own medical liability insurance.

Our full Insight on both Vicarious Liability cases is available here.

Manager who intentionally submitted a false investigation report was not wrongfully dismissed

Human Kind Charity v Gittens – Employment Appeal Tribunal (25 October 2019, published 09 March 2020)

The EAT (overturning the Employment Tribunal) allowed the charity’s appeal against a finding of wrongful dismissal: the charity had been entitled to terminate a manager’s employment summarily for submitting a false investigation report.

The charity had appealed the ET’s finding that there was no wrongful dismissal on the grounds that the ET misapplied Ranson v Customer Services plc by deciding that the Claimant was not under a duty to report her own wrongdoing when asked to investigate an incident, as there was no express contractual requirement to disclose any wrongdoing.

The EAT agreed that the ET had misdirected itself in law by applying Ranson to a case in which the employee did not remain silent but submitted an Investigation Report which was “not true” and in which “there was clearly some element of dishonesty” (as found by the Employment Tribunal). The right to remain silent (where it exists) is not the same as a right to say something that is not true. The EAT set aside the finding of wrongful dismissal (Bell v Lever Bros Ltd and Item Software (UK) Ltd v Fassihi considered).

The ET had conflated an employee's right not to disclose their own wrongdoing where they owed no fiduciary duty with the right to say something that is not true.

Ms Gittens was a manager, and her team’s shared iPad incurred a data bill of £8,523. In an investigative report Ms Gittens claimed she was unable to narrow the data charges down to one person. The company asked another employee to investigate. Ms Gittens later admitted she had the iPad at the time the charges were incurred. Follow a disciplinary process, Ms Gittens was dismissed for gross misconduct on the grounds of dishonesty / breach of trust and confidence in her role. The ET dismissed Ms Gittens’ claims for unfair dismissal and discrimination but upheld a claim for “breach of contract in relation to three months’ notice pay” (a claim for wrongful dismissal).

The wrongful dismissal test is an objective test; a tribunal must decide whether an employee is responsible for a repudiatory breach of their employment contract. The ET had wrongly focused on the lack of an express term in the employment contract requiring the employee to disclose her own wrongdoing. The EAT referred to authorities which held there was an implied term in all employment contracts regarding breach of trust and confidence, and that a breach of this implied term is a repudiatory breach. The ET had found that with Ms Gittens’ initial investigation report "there was clearly some dishonesty".

Employers should ensure that when there are shared team IT resources (which incur costs) team members are aware of cost implications of using these and are provided with a usage policy. Where appropriate, have a log to document which team member is using the IT resource at a given time.

Court of Appeal considers knowledge test for inducing breach of post-termination restrictive covenants; defendant must know they are inducing an act which will breach a contract

Allen v Dodd – Court of Appeal (27 February 2020)

There is no liability for inducing a breach of contract where a party honestly relied on legal advice that its proposed actions would not amount (or would probably not amount) to a breach of contract. This is the case even if that advice turns out to be wrong. The test for state of mind is subjective.

The Court of Appeal held that an accountancy firm (the “new employer”) was not liable for inducing a breach of contract where it recruited a tax adviser (the “new recruit”) in breach of his contractual post-termination restrictions, having received advice that the restrictions were probably not enforceable.

In order to bring a claim for inducing a breach of contract, the claimant must show that the third party knowingly and intentionally induced or procured the breach without reasonable justification, and that the claimant suffered economic loss. In this case, although the legal advice obtained turned out to be incorrect, the firm had been entitled to rely on it and did so honestly.

The fact that the legal advice received had not been unequivocal did not mean that the firm's defence failed. In order for a defendant to be liable for the tort of inducing a breach of contract, the claimant must prove the defendant's actual knowledge of the breach; it is not for the defendant to prove an absolute belief that there would be no breach.

Acknowledging that lawyers rarely give unequivocal advice, the court held that people should be able to act on legal advice, responsibly sought, even if the advice turns out to be wrong. The tort of inducing a breach of contract applied to all sorts of commercial contracts. While there were relatively clear guidelines about the enforceability of restrictive covenants in employment contracts, those guidelines did not exist in other fields of commercial activity. In addition, the relevant knowledge was not simply knowledge of a fact, but knowledge of a legal outcome.

If the belief is held honestly but unreasonably, there would be no liability for the tort of inducing breach of contract. On a public policy point, people should be able to act on legal advice, responsibly sought, even if the advice turns out to be wrong. This will assist “poachers” (the new employer): an honest belief in legal advice suggesting that the covenants are unlikely to be enforceable may allow them to escape liability for inducing a breach of contract.

Tribunal failed to recognise that there was good reason to address claimant's mental capacity to conduct litigation

Royal Bank of Scotland plc v AB – Employment Appeal Tribunal (27 February 2020)

The EAT held that a tribunal erred both (i) in failing to assess the claimant's mental capacity during proceedings before it and (ii) in rejecting an application to reconsider its decision. The Honourable Mr Justice Swift said that tribunals clearly must take care before concluding that an assessment of a litigant's capacity to litigate is necessary, but where there is legitimate reason to doubt a litigant’s capacity to litigate, that issue must be addressed.

The EAT rejected the Employment Tribunal’s reasons for not ordering an assessment on the basis that: (i) neither psychiatric expert had examined the Claimant in 3 months; (ii) ET placed too much weight on the assertion of the Claimant’s legal team that they could take instructions; and (iii) based on the Claimant’s behaviour, there was good cause that the Claimant may lack capacity.

In this case, the tribunal ought to have recognised that it had good reason to suspect that the claimant did not have capacity, since she appeared unable to recognise her counsel and to answer simple questions.

The Mental Capacity Act provides an assumption that an individual has mental capacity, unless its established that they do not. The relevant test for whether to conduct an assessment for capacity is “good cause for concern”. The ET should have made its own assessment about whether the claimant had capacity or whether to refer to medical experts, and then consider if this overrides the presumption of capacity.

For more key employment law updates from us:

• read our Insights on key developments over the last month;
• stay Ahead of the Curve with our summaries covering the key aspects of employment law under review by the government;
• scroll through our key dates timeline showing recent and anticipated changes to employment law; and
• attend our upcoming events or catch up on training.