Employer vicariously liable for employee’s data protection breach
The High Court has held that an employer was vicariously liable for its employee’s data protection breaches. A senior internal auditor, motivated by a grudge against his employer, Morrisons, was convicted and sentenced to 8 years in prison for breaching the Data Protection Act 1998 after he deliberately published online the personal data of 100,000 colleagues.
Morrisons was not primarily liable for the data breach as it had generally put adequate controls in place to protect the data, and its one error in this regard didn’t cause or result in the data breach. However, the High Court said Morrisons was vicariously liable for the employee’s actions. The employee had received and copied the personal data during the course of his employment, and Morrisons was vicariously liable for his acts, despite the fact that the employee had leaked the data using his personal computer outside of working hours.
Why this matters?
This decision highlights that an employer can be vicariously liable for an employee’s data protection breach even where the employer has taken appropriate measures to prevent the breach. Because of the potentially significant number of victims who may seek damages for distress following a data breach (there are over 5,500 claimants bringing claims against Morrisons), the implications for employers are substantial. The judge suggested that the potential financial consequences of the decision for employers could be met by taking out appropriate insurance. Given the significance of this issue, Morrisons has been given leave to appeal.
With the General Data Protection Regulation coming into force in May 2018, the implications of data breaches for employers will become even more significant.
Article 8 privacy rights infringed by installation of surveillance cameras
The European Court of Human Rights (ECtHR) has held by a majority that the installation of video cameras in lecture theatres infringed university professors’ rights under the Article 8 right to respect for private and family life.
The ECtHR emphasised that Article 8 guarantees a right to private life in a broad sense – including the right to lead a “private social life”. This includes professional activities and activities taking place in a public context (such as a public teaching auditorium, where it was held that the professors could develop their social identity). The state of Montenegro submitted that the individuals concerned had been made aware of the cameras, but the ECtHR held that such surveillance could be an intrusion into private life whether or not it is covert, and the reasons for the monitoring were not justified in this case.
Why this matters?
This follows the widely publicised recent case of Barbulescu v Romania (discussed in our October 2017 blog), where the Grand Chamber overturned the ECtHR’s original decision and held that monitoring employees’ personal messages on work-related accounts can breach Article 8 rights. In the UK, the Information Commissioner’s Employment Practices Code sets out best practice recommendations for employers on video and audio monitoring.
Whistleblowing: Raising concerns purely out of self-interest does not satisfy “public interest” test
The EAT has upheld an Employment Tribunal’s decision that an employee who raised issues purely out of concern for her own potential liability was not protected by whistleblowing legislation. The employee, a Legal and Compliance Officer, had raised various concerns in the course of her six weeks in the role, but these focused on her own fear of being personally liable. The EAT upheld the Tribunal’s finding that she had not made the disclosures in the reasonable belief that they were in the public interest.
The EAT also agreed that there was no causal connection between the employee’s dismissal (for being a “cultural misfit”, according to the employer) and the disclosures she had made. Her claim for automatic unfair dismissal therefore failed.
Why this matters?
This decision will be welcomed by employers, as it goes against the tide of recent decisions which appear to widen the scope of disclosures that satisfy the “public interest” test. However, employers should exercise caution, as this case is fact-specific, and the Court of Appeal’s decision in Chesterton v Nurmohamed indicates that an employee who has both their own self-interest and the public interest in mind when they make a disclosure can still claim whistleblowing protection.
Concerns raised by employees in Compliance roles are often more likely to amount to protected disclosures because of the nature of their work. It is especially important for employers to be able to show that any dismissals of such employees are for reasons that are clearly separate from concerns those employees have raised.
Court of Appeal confirms established view that the claimant has initial burden of proof in discrimination cases
The Court of Appeal has dismissed an appeal by a former Citylink employee, upholding the decision that the employee had not discharged his initial burden of establishing a prima facie case for discrimination. The Court said that it was permissible to take into account evidence presented by the Respondent when considering whether the Claimant had discharged such a burden.
Why this matters?
The EAT in Efobi v Royal Mail Group Ltd (discussed in our September 2017 blog) had suggested that the wording of the Equality Act 2010 had changed the burden of proof test from that in previous discrimination legislation, and that there was no longer an initial burden of proof on the claimant. However, the Court of Appeal has now confirmed that the decision in Efobi was incorrect, and that the burden of proof test in the Equality Act remains unchanged from earlier discrimination legislation. The claimant therefore has the initial burden of demonstrating a prima facie case of discrimination before the burden shifts to the Respondent to give a non-discriminatory explanation.
Round up of other developments
Rights of EU nationals in the UK post-Brexit: Following the conclusion of ‘phase 1’ of the Brexit negotiations, the UK Government has confirmed that citizens of other EU countries who arrive in the UK by 29 March 2019 will be able to stay in the UK.
Employment Tribunal claims: The number of employment tribunal claims lodged between July and September 2017 increased by 64% since the same period in 2016, according to the Ministry of Justice’s quarterly statistics. This dramatic increase coincides with the abolition of tribunal fees on 26 July 2017.
Statutory pay rates: The Department for Work and Pensions has announced proposed increases to statutory pay rates from April 2018, as follows:
- Statutory maternity, paternity, adoption, shared parental pay and maternity allowance – £145.18 per week (up from £140.98); and
- Statutory sick pay – £95.05 per week (up from £89.35).
Gender Pay Gap Reporting: The Equality and Human Rights Commission (EHRC) has opened a consultation on its draft strategy for ensuring compliance with the Gender Pay Gap Reporting Regulations. Following informal engagement with employers, the proposals include the EHRC entering into written agreements with employers, issuing unlawful act notices, and ultimately imposing unlimited fines and summary convictions.