Skip to content

The issue of vicarious liability has been the source of many cases in the UK. The Supreme Court have taken the opportunity in this recent case to provide a neat summary of the key cases to date, the development of the law and the correct test to be applied. While there had been many vicarious liability cases considering the impact of an employees actions on a third parties, the Supreme Court highlighted that there was no previous case law where the employer was vicariously liable for a wrongdoing that was orchestrated to cause harm to the employer.

This high profile case related to Mr Skelton, a previous employee of Morrison, who appeared to take great offence to minor misconduct proceedings. Mr Skelton sought his ‘revenge’ on Morrison when he was asked to provide payroll data to auditors. Mr Skelton provided the data but also took a copy and uploaded 98,998 employee’s data to a publically accessible file sharing site and other websites.

Mr Skelton was convicted of numerous offences and sentenced to 8 years imprisonment. However a claim was also brought against Morrison on the basis that they were vicariously liable for Mr Skelton’s actions.

In the first instance Morrison were found to be vicariously liable. This was appealed but the Court of Appeal dismissed the appeal and upheld that they were vicariously liable. Morrison took the matter to the Supreme Court.

The Supreme Court carefully examined the previous decisions and case law. They found that the Court of Appeal had misunderstood the principles that govern vicarious liability.

The Supreme Court set out that the question to ask in cases of vicarious liability comes from the case of Dubai Aluminium [2003] 2 AC 366 and is as follows:

“Whether Mr Skelton’s disclosure of data was so closely connected with acts he was authorised to do that, for the purpose of the liability of his employer to third parties, his wrongful disclosure may fairly and properly be regarded as done by him while acting in the ordinary course of his employment”.

A key focus of the Supreme Court was the reason why Mr Skelton had acted wrongfully. Was it a “frolic of his own” or was he “acting on his employer’s business”. The Supreme Court took the view that it was “abundantly clear” that Mr Skelton was exercising a “personal vendetta” in this case. As a result, the ‘close connection’ test set out above could not be satisfied.


The Supreme Court ruled that Mr Skelton’s actions can not “fairly and properly be regarded as done by him while acting in the ordinary course of his employment”. They also clarified that simply permitting him access to the data and therefore enabling the breach, was not sufficient in itself to make Morrison vicariously liable.

Morrison’s appeal was upheld and they were found not to be vicariously liable in this case!  

For more information or guidance on employment related matters, please contact our Employment Law team: [email protected]