At the Supreme Court: Morrisons not liable for rogue employee’s data breach

The Supreme Court’s decision that Morrisons was not vicariously liable for the actions of a former employee will be of interest to health and care organisations up and down the country. The decision will provide comfort to healthcare data controllers concerned by the earlier findings of the High Court and Court of Appeal on the issue of vicarious liability.

The decision is not just of interest from a data protection perspective, but also from the perspective of wider questions of employer liability for the acts of others. How health and care organisations safeguard patients’ health data is a key governance and board issue.

To read more on the decision and its implications, head over to our sister blog, fusion: legal updates for the education sector. 

Also of interest to the heath and care sector will be the Supreme Court’s decision in the Barclays case also published yesterday. The Supreme Court ruled that Barclays Bank was not vicariously liable for acts of sexual assault committed by a self-employed GP that it had engaged to conduct pre-employment medical assessments. 

The fact that cases on vicarious liability reach the Supreme Court on a regular basis, and often involve overturning the decisions of lower courts underline the complex legal and factual analysis which can be required in cases of vicarious liability.