And speaking of swallowing a great deal brings me to the indigestion-inducing case of WM Morrison Supermarkets plc v Various Claimants [2020], in which the Supreme Court determined whether an employer can be held vicariously liable for an employee's deliberate, malicious act of leaking colleagues' personal data, carried out for purely personal reasons.

Supermarket chain Morrisons employed Andrew Skelton as a senior auditor in its internal audit team. In 2013, Skelton was given a verbal warning following disciplinary proceedings, after which he developed a grudge against the company. Later that year, he was tasked with collating payroll data for around 126,000 staff and sending it to KPMG, Morrisons' external auditors, as part of the annual audit process. This gave him access to highly sensitive information, including employees' bank details, salaries and National Insurance numbers.

Rather than simply passing the data to KPMG as instructed, Skelton secretly copied it onto a personal USB stick. Using a fake email account and software designed to hide his identity, he then uploaded the data of almost 100,000 employees to a public file-sharing website, before sending copies anonymously to several newspapers. Morrisons acted quickly to have the data removed and spent over £2.26 million managing the fallout, but the damage was done. Skelton was later jailed for eight years, and a large group of affected employees brought a claim against Morrisons itself.

Around 9,263 employees and former employees sued Morrisons for breach of the Data Protection Act 1998, misuse of private information, and breach of confidence, arguing that the company was vicariously liable for Skelton's actions.

The High Court found that Morrisons was not directly at fault, but held that it was vicariously liable for Skelton's wrongdoing. The judge reasoned that there was an unbroken chain of events connecting Skelton's authorised task of handling the payroll data to his decision to disclose it, and that this was enough to fix Morrisons with liability. The Court of Appeal agreed, finding that Skelton's actions fell within the field of activities Morrisons had assigned to him, even though his motive was to harm his employer rather than benefit it.

Morrisons appealed to the Supreme Court, which overturned both decisions. The Court clarified that the lower courts had misapplied the test for vicarious liability, wrongly focusing on whether there was a temporal or causal link between Skelton's job and his wrongdoing, rather than asking whether his conduct was closely connected to what he was actually authorised to do. The Supreme Court held that Skelton was not furthering Morrisons' business when he disclosed the data; he was pursuing a personal vendetta, acting wholly outside the scope of his employment. Crucially, his motive was found to be highly relevant, not irrelevant as the lower courts had assumed, since it confirmed he was acting for himself and not for his employer. The Court also confirmed that the Data Protection Act 1998 did not, in any event, exclude an employer's vicarious liability for breaches of the Act. On the facts, however, Morrisons was found not liable for Skelton's conduct, and the appeal was allowed.

This case shows that employers will not automatically be held responsible for an employee's deliberate wrongdoing simply because their job gave them access to the means of causing harm. Where an employee acts for entirely personal reasons, on a frolic of their own rather than in furtherance of their employer's business, vicarious liability is unlikely to follow. That said, this case should not breed complacency: employers still need robust data protection safeguards, since the legal test remains fact-sensitive and a closer connection between an employee's role and their wrongdoing could easily produce a different outcome.