This case ‘ Various Claimants v Wm Morrisons Supermarket PLC ’ raised the question of whether an employer is liable, directly or vicariously, for the criminal actions of a rogue employee in disclosing personal information of co-employees on the web, whether under the Data Protection Act (DPA) 1998, an action for breach of confidence, or in an action for misuse of private information. On 12 January 2014 a file containing personal details of 99,998 employees of Morrisons was posted on a file sharing website. Shortly after that, links to the website were also placed elsewhere on the web. The data consisted of the names, addresses, gender, dates of birth, phone numbers (home or mobile), national insurance numbers, bank sort codes, bank account numbers and the salary which the employee in question was being paid. On 13 March 2014, a CD containing a copy of the data was received by three newspapers in the UK, none of which used the information and subsequently informed Morrisons. The person sending the CD did so anonymously, purporting to be a concerned person who had worryingly discovered that payroll data relating to almost 100,000 Morrisons employees was available on the web. It gave a link to the file-sharing site. The judge concluded that the DPA does not impose primary liability upon Morrisons; that Morrisons have not been proved to be at fault by breaking any of the data protection principles, save in one respect which was not causative of any loss; and that neither primary liability for misuse of private information nor breach of confidentiality can be established.
However, the judge rejected the arguments that the DPA upon a proper interpretation is such that no vicarious liability can be established, and held that, secondary (vicarious) liability is established.
The judge granted leave to Morrisons to appeal the conclusion as to vicarious liability, should they wish to do so, so that a higher court may consider it: but would not, without further persuasion, grant permission to cross-appeal the conclusions as to primary liability. The employees of Morrisons whose data was disclosed are claiming compensation both for breach of statutory duty (under Section 4(4) of the DPA) and at common law (the tort of misuse of private information, and equitable claim for breach of confidence).
This particular trial has been concerned only with liability. If the court should find in favour of the Claimants in respect of their claims, then the compensation amount is to be assessed later.
General Data Protection Regulation (GDPR) With less than 6 months until GDPR comes into force; take a worthwhile half hour to find out the key areas of change from the Data Protection Act and what you should be doing to prepare. CIPP webcast on General Data Protection Regulation (GDPR) The CIPP also run a half day training course which will help delegates understand and prepare for the changes, including how they affect payroll and HR functions, so that they can help their organisations become fully compliant by May 2018.
Back to Contents
Uber appeal on 'worker' status 6 November 2017
Uber's application to 'leapfrog' an appeal to the Supreme Court has been refused.
Last month, the Employment Appeal Tribunal dismissed Uber's appeal in Uber BV v Aslam , upholding the employment tribunal's decision that Uber drivers were 'workers'. Uber announced an appeal and applied for permission to 'leapfrog' the Court of Appeal and go straight to the Supreme Court, something which is only granted in a tiny minority of extremely important cases.
Having been refused permission to leapfrog, the appeal will now be heard by the Court of Appeal some time next year.
Meanwhile, the Pimlico Plumbers case on worker status is due to be heard by the Supreme Court in February 2018, which will give the Supreme Court an opportunity to review worker status (albeit not in the context of the 'gig' economy) very soon.
The Chartered Institute of Payroll Professionals
Policy News Journal
cipp.org.uk
Page 92 of 516
Made with FlippingBook - Online magazine maker