The Morrisons case: When is an employer liable for data breaches by its employees?
❗Flash Briefing from the UK❗
⚡Kim Walker of Shakespeare Martineau discusses the UK Supreme Court’s important recent judgement clarifying the scope of the principle of “vicarious liability”: when is an employer strictly liable for the wrongdoings of its employees even though the employer is entirely blameless?
➡️ The case is of particular interest to anyone advising on dataprotection, because the employee, in this case, had maliciously and wrongfully uploaded payroll data of 100,000 employees to the internet, potentially exposing Morrisons to huge claims for compensation from the employees involved.
➡️ The High Court and the Court of Appeal in the UK had previously found Morrisons vicariously liable for the rogue employee’s actions.
The discussion includes:
❓How do you decide what an employee’s “field of activities” are?
❓When is the wrongful action “closely connected” to the field of activities?
❓Are the employee’s motives relevant?
❓Why was the previous leading case (Mohamud v Morrisons) different?
❓What are the practical implications in the field of data protection?
