What to look out for in 2020: Attributing corporate liability

In brief

• liability risk for corporate entities, and their insurers, has increased in recent years. A number of factors have contributed. The scope of corporate criminal liability has widened, while increased regulation and greater reliance on technology are also factors.
• alongside these developments, we have seen a greater willingness by the Courts to impose liability on parties who may not be the primary wrongdoer.
• employers have increasingly found themselves being held strictly liable for the wrongful acts of their employees. While the principle of vicarious liability is not new, it can mean unexpected and unforeseen areas of risk. Two decisions of the Supreme Court are pending which will shine a spotlight on this.

Vicarious liability for employee wrongdoing

Vicarious liability is a principle by which no-fault liability can be imposed on one party for wrongful acts or omissions committed by another. This is usually imposed in the context of wrongdoing by an employee, or someone with a relationship “akin to employment”. Even though the employer is not the real wrongdoer, liability is imposed on the basis that it is fair, just and reasonable for the party with the means to compensate the victims to bear the loss.

In Singularis v Daiwa, the Supreme Court confirmed that context is all when asking whether an employee’s wrongdoing should be attributed to the employer.

Regulation of data use is a major risk for businesses. In our publication we considered the Court of Appeal decision in the action brought by multiple Morrisons supermarket employees after a fellow employee had misused their personal data. The Court of Appeal held that the malicious and deliberate disclosure of data by the Morrisons employee occurred in the course of his employment, holding Morrisons vicariously liable. The Supreme Court decision is pending on the question of whether this decision was right, and whether the Data Protection Act excludes the application of vicarious liability to a breach of the DPA, or for misuse of private information or breach of confidence.

Notably, there was no suggestion of systems failures by the supermarket. The High Court found that Morrisons had more or less done everything it could and should have done to ensure the safety and security of the data and was therefore not directly liable for any breach. Given that the employee’s actions were in revenge for disciplinary action which Morrisons had taken against him, this decision was troubling for many.

Vicarious liability can also apply to relationships which are “akin to employment”. We also await the Supreme Court’s decision on the question of whether a judge adopted the correct approach when determining that a bank was vicariously liable for sexual assaults committed by a doctor during medical examinations of the bank's current and prospective employees.

In Morrisons, the Court of Appeal referred to the availability of insurance as an answer to the potentially large number of claims to which “innocent” corporates might be exposed. Similarly, in considering the vicarious liability of a bank for the acts of a doctor, the Court of Appeal said that the bank had more means to satisfy the claims than the late doctor’s estate. Although in both cases the court expressly stated that the question of means was not decisive of the question of liability, it is telling that the issue was given consideration.

What this means for you

• vicarious liability is one contributing factor to increased liability risk for businesses and corporations. In particular, it can mean that even entities with robust systems in place are exposed.
• the Courts have demonstrated a greater appetite to turn to parties with the deepest pockets. Vicarious liability is not new, but we may see the Courts considering that it is “fair, just and reasonable” to impose vicarious liability more frequently.
• increasingly, regulation includes strict or 'no fault' offences and the two high profile Supreme Court decisions due in 2020 will determine the limits for the courts’ appetite for imposing vicarious liability.
• the question in the Morrisons case of the compatibility of the DPA with the application of vicarious liability is key for all businesses which hold or process data.

We will bring you updates on the key cases when the judgments are handed down.