WM Morrison v Various Claimants [2020] UKSC 12: A photo of The UK Supreme Court. (Photo credits: Interior FM)


On 1 April 2020, the United Kingdon Supreme Court delivered its decision in WM Morrison v Various Claimants (“Morrison”) [2020] UKSC 12. Morrison’s appeal against the Court of Appeal’s ruling that it was vicariously liable for the wrongful act of its former employee in releasing confidential information about its employees on the internet was allowed.        

Morrison operates a chain of supermarkets. It employed one Skelton as a senior auditor in its internal audit team. In July 2013, Skelton was given a verbal warning by Morrison following an internal disciplinary proceeding. Bearing a grudge against Morrison, he plotted to exact vengeance.   

The opportunity came when in the course of the 2013 annual audit of Morrison’s accounts, its external auditor, KPMG, requested payroll data from Morrison to test for accuracy. The head of Morrison’s internal audit delegated the task of collating and transmitting the data to Skelton, a task he had performed the previous year. To enable him to carry out the task, Skelton was given access to the payroll data of Morrisons’ workforce of around 126,000 employees. He thus had access to confidential information such as the date of birth, phone numbers, national insurance number, bank sorting code, bank account number and salary of each member of staff.

What Morrison did not bargain for was that Skelton would surreptitiously make a copy of the data for himself and thereafter upload the data of close to 100,000 of Morrison’s employees to a publicly accessible file-sharing website. Skelton’s antics were discovered and he was convicted and imprisoned.

Subsequently, more than 9,000 of Morrison’s employees or former employees commenced an action against it for Skelton’s transgressions. They pleaded breach of the UK Data Protection Act 1998, misuse of private information and breach of confidence. Among other things, the claimants pleaded that Morrison was vicariously liable for Skelton’s misdeeds.


The trial was bifurcated. Both the High Court and the Court of Appeal found Morrison vicariously liable. In doing so, they relied on the UKSC decision in a case which coincidentally involved Morrison, namely, Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11 (“Mohamud”). In that case, the employee (“Khan”) had assaulted a customer of Morrison. In finding Morrison vicariously liable for Khan’s transgressions, Lord Toulson, who delivered the judgment, stated that there had been “a seamless and continuous sequence of events … an unbroken chain” adding that Khan’s motive in carrying out the assault was irrelevant. The Court of Appeal had observed that an unusual feature of the case was that Skelton’s motive for his action was to harm his employer; however, given Lord Toulson’s statement that motive is irrelevant, the Court of Appeal thus found Morrison vicariously liable.

Morrison appealed to the UKSC. In delivering its decision, the UKSC remarked that the case provided it with the opportunity to address what it regarded as the misunderstandings which have arisen since its decision in Mohamud and in particular, those parts of Lord Toulson’s judgment referred to in the preceding paragraph.


The UKSC allowed Morrison’s appeal. In so doing, it adopted the long-established “close connection” test: vicarious liability is imposed where the unauthorised acts of the employee are so closely connected with acts which the employer has authorised that they may fairly and properly be regarded as being done by the employee while acting in the ordinary course of his employment.

The UKSC made clear that Lord Toulson was not intending to effect a change in the law: quite the contrary. It explained that on a proper reading of His Lordship’s judgment, Lord Toulson was far from suggesting that determining the question of whether vicarious liability ought to be imposed merely required the court to consider whether there was a temporal or causal connection between the employment and the wrongdoing, and whether it was right for the employer to be held liable as a matter of social justice. Lord Toulson in fact applied the close connection test.

As for His Lordship’s statement that motive is irrelevant, the UKSC explained that Lord Toulson had in fact been misunderstood on the facts of Mohamud (at [29] – [30]): the primary tortfeasor’s motive is relevant in determining whether the close connection test is satisfied.    

Based on its clarification of what Lord Toulson meant, the UKSC thus ruled that the High Court judge and the Court of Appeal had erred in (among others) the following respects in finding Morrison vicariously liable:

31. … First, the disclosure of the data on the Internet did not form part of Skelton’s functions or field of activities, in the sense in which those words were used by Lord Toulson: it was not an act which he was authorised to do, as Lord Nicholls put it. … Thirdly, although there was a close temporal link and an unbroken chain of causation linking the provision of the data to Skelton for the purpose of transmitting it to KPMG and his disclosing it on the Internet, a temporal or causal connection does not in itself satisfy the close connection test. Fourthly, the reason why Skelton acted wrongfully was not irrelevant: on the contrary, whether he was acting on his employer’s business or for purely personal reasons was highly material.

The UKSC then considered the issue of Morrison’s vicarious liability afresh using the close connection test. It surveyed the decided cases and in particular, the House of Lords’ decision in Dubai Aluminium Co Ltd v Salaam [2003] 2 AC 366. In the final analysis, the UKSC concluded that the close connection test was not satisfied in the case before them pointing out (at [47]):

… the distinction drawn by Lord Nicholls at para 32 of Dubai Aluminium [2003] 2 AC 366 between “cases … where the employee was engaged, however misguidedly, in furthering his employer’s business, and cases where the employee is engaged solely in pursuing his own interests: on a ‘frolic of his own’, in the language of the time-honoured catch phrase.

In the present case, it is abundantly clear that Skelton was not engaged in furthering his employer’s business when he committed the wrongdoing in question. Quite the contrary, as he was pursuing a personal vendetta, seeking vengeance for the disciplinary proceedings some months earlier.

In those circumstances, applying the test laid down by Lord Nicholls in Dubai Aluminium in the light of the circumstances of the case and the relevant precedents, Skelton’s wrongful conduct was not so closely connected with acts which he was authorised to do that, for the purposes of Morrisons’ liability to third parties, it can fairly and properly be regarded as done by him while acting in the ordinary course of his employment.


The Singapore courts adopt the same close connection test in determining vicarious liability (Skandinaviska Enskilda Banken AB (Publ), Singapore Branch v Asia Pacific Breweries (Singapore) Pte Ltd and another and another appeal [2011] 3 SLR 540). In so far as this decision removes any uncertainties arising from a misunderstanding of Lord Toulson’s judgment in Mohamud, it is most welcome.

To read the full judgment, click here.