High Court rejects claim council was vicariously liable after employee on “frolic of her own” leaked social care records

Luton Borough Council was not vicariously liable for the acts of an employee who leaked sensitive data about a woman and her children, in what a High Court judge called a "classic case" of the employee being on a "frolic of her own".

The claim against Luton centred around a data breach in which a council employee who had access to its social care case management records divulged information to the claimant's husband about a complaint the claimant had made against him to the police.

The council had data about the family on its case management system due to a previous referral to social services.

In 2019, it emerged that the council employee, who was in a relationship with the claimant's husband, had accessed the claimant's data.

The wife went on to make individual complaints to the police and to Luton in relation to the handling of her personal information. 

Considering the claim against the council in Ali v Luton Borough Council [2022] EWHC 132 (QB) (27 January 2022), Judge Richard Spearman QC, sitting as a Judge of the Queen's Bench Division, found that the defendant was not vicariously liable, under the guidance set out in Various Claimants v Wm Morrison Supermarkets plc [2020] AC 989 by the Supreme Court. 

The judge said the issue fell to be determined by applying the law as declared by the Supreme Court in Morrison, and in particular, the test reiterated by Lord Reed PSC at [25]:

"[In] a case concerned with vicarious liability arising out of a relationship of employment, the court generally has to decide whether the wrongful conduct was so closely connected with acts the employee was authorised to do that, for the purposes of the liability of his employer, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment."

Counsel on behalf of the claimant submitted that the proper application of the Morrison test to the facts of the case proved vicarious liability.

In addition, they argued that other decided cases, including those which are concerned with claims for sexual abuse, provide additional helpful guidance. In that context, they emphasised the role which the employee was entrusted by the defendant to perform and the nature of the information in question. 

There were welfare and safeguarding aspects to both that role and that information, and these considerations were relevant and gave rise to an analogy with the sexual abuse cases, they added. 

The defendant contended that the Morrison case was not only the starting point but for "all practical purposes the finishing point for the analysis which is applicable in the present case". They highlighted the factual similarities between the two cases: both concerned data breaches and an employee who misused data to further the employee's personal agenda (as opposed to furthering the business of the employer). 

In addition, they submitted that the argument against a finding of vicarious liability was, if anything, stronger in the present case. This was because, in Morrison, the employee had misused for purposes of his own vendetta against the employer data, which the employer had tasked him with using lawfully for purposes of the employer's business. Whereas in the present case, the employee misused for her own purposes of assisting the claimant's husband data which she was not required to use in any way by the council and instead accessed improperly and in breach of both the defendant's protocols and her own contract of employment. 

In reaching his conclusion, Judge Spearman found that the employee, as with the employee in Morrison, was "in no way engaged, whether misguidedly or not, in furthering the business of her employer" when she accessed and processed the data.

The judge added: "Although [the employee] gained the opportunity to access and process data relating to the claimant (and the children) by reason of the unrestricted access to the Liquid Logic system which she was required to be afforded in order to perform her role as a contact centre worker, it formed no part of any work which she was engaged by the defendant to do to access or process those particular records. Indeed, if [the employee] had disclosed her connection with the claimant's husband, as she ought to have done, her access to these records would have been restricted by the defendant."

In doing what she did, the employee was engaged solely in pursuing her own agenda, namely divulging information to the claimant's husband, with whom she had some relationship, the judge said. "Further, that was to the detriment of the Claimant (and the children) whose safety and interests as users of the Defendant's services it formed part of [the employee's] core duties to further and protect."

He added: "This was, in my judgment, a classic case of [the employee] being on a 'frolic of her own'".

Comparing the case with the facts of Morrison, the judge said it did not matter that it did not take the form of a vendetta against her employer, as in the case of the defendant in Morrison.

He said that the differences between the facts of the cases made the local authority's case stronger because the Morrison defendant was engaged in using unlawfully data which he had been tasked with processing lawfully, "whereas in the present case [the employee] was not tasked in any shape or form with either accessing or disseminating the information in question". 

"Nor, in my judgment, does the safeguarding element of [the employee's] job assist the claimant's case. Indeed, in my view that feature merely serves to underline how plainly [the employee] was not engaged in furthering the business of the defendant, but was instead engaged in furthering her own ends, in contradiction to those of the defendant."

"In those circumstances, applying the authoritative test laid down in Morrison in the light of the circumstances of this case and the relevant case law, [the employee's] wrongful conduct was not so closely connected with acts which she was authorised to do that, for the purposes of the Defendant's liability to third parties, it can fairly and properly be regarded as done by her while acting in the ordinary course of her employment."

The judge dismissed the claim. 

Adam Carey