The Honourable Justice of the High Court of Justice's ('the High Court') Queen's Bench Divison, Brian Langstaff, issued, on 1 December 2017, his decision in relation to the class action in Various Claimants v. Wm Morrisons Supermarket PLC, addressing whether Morrisons could be held liable for the criminal actions of Andrew Skelton, who disclosed personal data of co- employees. The High Court determined that although the Data Protection Act 1998 would not impose primary liability on Morrisons, vicarious liability could be established by applying the principles of Mohamud v William Morrison Supermarkets PLC.
In particular, the High Court held, "Morrisons did not directly misuse any information personal to the data subjects. Nor did they authorise its misuse, nor permit it by any carelessness on their part." However, regarding vicarious liability, the High Court concluded, "Lord Toulson explained those cases in which liability had been upheld as being those where the employee misused his position in a way which injured the claimant, and that it was just that the employer who selected him and put him in that position should be held responsible. He was putting great weight on 'enterprise risk.' I would add to his exposition only that the employer, too, had at least the theoretical right to control. Though employers can hardly tell highly skilled workers the detail of how to do their jobs, it remains a necessary element in every contract of employment that the employer has '…lawful authority to command so far as there is scope for it. and there must always be some room for it, if only in incidental or collateral matters' […] An employer, in general, remains responsible for what work is done, where and when, under what systems and with what equipment, and who the clients or customers are to be. The employer could theoretically place a would-be tortfeasor who is an employee in a position where he could not so easily commit the tort, and design systems to prevent it occurring which the employee could be directed to observe. [...] Adopting the broad and evaluative approach encouraged by Lord Toulson in Mohamud, I have therefore come to the conclusion that there is a sufficient connection between the position in which Skelton was employed and his wrongful conduct, put into the position of handling and disclosing the data as he was by Morrisons (albeit it was meant to be to KPMG alone), to make it right for Morrisons to be held liable 'under the principle of social justice which can be traced back to Holt CJ.'"