ISMA ALI v LUTON BOROUGH COUNCIL [2022] EWHC 132 (QB)

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
[2022] EWHC 132 (QB)Case No Case No: QB-2020-001180Venue Royal Courts of Justice, Strand, London, WC2A 2LL
Between
ISMA ALIClaimantLUTON BOROUGH COUNCILDefendant
Before
RICHARD SPEARMAN Q.C. (Sitting as a Judge of the Queens Bench Division)Tom Clarke (instructed by Irvings Law) for the ClaimantJack Harding (instructed by Weightmans LLP) for the DefendantHearing dates: 17 and 18 January 2022Date 27 January 2022
[1]Covid-19 Protocol: This judgment was handed down remotely by circulation to the parties' representatives by email, release to BAILII and publication on the Courts and Tribunals Judiciary website. The date and time for hand-down is deemed to be 10:30am on 27 January 2022. Richard Spearman Q.C.: INTRODUCTION In this case it is not in dispute that an employee of the Defendant, Rhully Begum, breached the rights of the Claimant by accessing and disclosing to the Claimant's husband information about the Claimant (and also the two young children of the family) which was stored on the Defendant's IT system. The issue is whether the Defendant is vicariously liable for Ms Begum's admittedly wrongful, and indeed criminal, acts.[2]It is common ground that this issue falls to be determined by applying the law as declared by the Supreme Court in Various Claimants v Wm Morrison Supermarkets plc [2020] AC 989 , and in particular the test reiterated by Lord Reed PSC at [25]:
"… in a case concerned with vicarious liability arising out of a relationship of employment, the court generally has to decide whether the wrongful conduct was so closely connected with acts the employee was authorised to do that, for the purposes of the liability of his employer, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment."
[3]On behalf of the Claimant, Mr Clarke submits that the proper application of that test to the facts of the present case leads to the conclusion that vicarious liability is made out. He further submits that other decided cases, including those which are concerned with claims for sexual abuse, provide additional helpful guidance. In that context, he emphasises in particular the role which Ms Begum was entrusted by the Defendant to perform and the nature of the information in question. There were welfare and safeguarding aspects to both that role and that information, and these considerations, as Mr Clarke submits, are relevant and give rise to an analogy with the sexual abuse cases.[4]On behalf of the Defendant, Mr Harding submits that the Morrison case is not only the starting point but for all practical purposes the finishing point for the analysis which is applicable in the present case. He draws attention to the factual similarities between the two cases: both concerned data breaches, and an employee who misused data to further the employee's personal agenda (as opposed to furthering the business of the employer). Indeed, Mr Harding submits that the argument against a finding of vicarious liability is, if anything, stronger in the present case: for example, in Morrison the employee had misused for purposes of his own vendetta against the employer data which the employer had tasked him with using lawfully for purposes of the employer's business, whereas in the present case Ms Begum misused for her own purposes of assisting the Claimant's husband data which she was not required to use in any way by the Defendant and instead accessed improperly and in breach of both the Defendant's protocols and her own contract of employment. Mr Harding contends that there is no need to look beyond Morrison for the purposes of deciding the present case, but in any event the further authorities upon which Mr Clarke relies do not assist the Claimant, and indeed, in common with the outcome in Morrison , point to the conclusion that the claim fails.[5]I am grateful to both Counsel for their clear and carefully presented submissions.[6]The claim was originally framed more widely, and included a case that the Defendant had a direct liability to the Claimant under various heads. However, that wider case was abandoned shortly before the beginning of the trial. In addition, neither side sought to challenge any aspect of the evidence of the other. The trial accordingly proceeded without oral evidence, and on the basis of the witness statements and documents alone. Finally, the parties agreed that, if liability was made out, the sum of £6,250 represented the amount of compensation which it would be appropriate to award to the Claimant. THE FACTS[7]The Claimant was married in 2015, and she and her husband later had two children. The marriage ran in to difficulties, which in due course culminated in a divorce. In the meantime, their problems led to the family having contact with social services, and to data relating to the Claimant and the children being compiled by the Defendant on a case management system utilised by the Defendant which is known as "Liquid Logic".[8]On 1 March 2019, before the marriage had come to an end and while it would appear the husband was still living in the family home, the Claimant made a complaint concerning the husband to the police. That in turn resulted in a Multi Agency Referral by the police to the Defendant, in essence on the basis that the subject matter of the complaint gave rise to safeguarding concerns relating to the Claimant and the children.[9]A few weeks later, the Claimant began to suspect that information relating to her had been leaked. Her family and friends began asking her questions about why she had involved the police, and when she asked people why they believed that she had gone to the police it emerged that her husband was saying that he had been informed of this by an individual who worked for the Council who he was now seeing. In light of what she had learned, the Claimant made complaints to both the police and the Defendant in relation to the way in which they had dealt with information concerning her. The complaint against the police has evolved into separate proceedings, which have yet to be tried. The complaint against the Defendant has evolved into the present proceedings.[10]In the meantime, the Defendant has accepted that it did not handle the complaint against it in a satisfactory manner, and, following an investigation and an apology, it paid the Claimant compensation in the sum of £2,570 in respect of that separate shortcoming.[11]It is the evidence of Steven Scott, who is employed within the IT team of the Defendant, that on 9 May 2019 he received a request to undertake a full audit trail of the case records relating to the Claimant and the children to see how they had been accessed. That request followed earlier contact with the Defendant. According to Mr Scott's evidence, that contact included: two telephone calls on 29 April 2019 in which the Defendant was informed that the Claimant's husband was saying that he had information which emanated from the Defendant and that he had a mistress working for Children's Services within the Defendant; and an email from the Claimant dated 8 May 2019 in which she stated (among other things) that her husband had pictures of her information on file and quotes of conversations held by Social Services, and had been showing people her records. Mr Scott completed his report on 14 May 2019. It showed, in summary:(i) that a total of 10 reports relating to the Claimant had been accessed on the Liquid Logic system on 26 April 2019 by Ms Begum,(ii) that 3 of those reports contained data of a highly sensitive nature which was capable of placing a family at risk;(iii) that Ms Begum had not accessed these records at any time prior to 26 April 2019, and was not shown to have printed anything on that date; and(iv) that Ms Begum had printed a 9-page document on 7 May 2019 which the Defendant suspects may have comprised information copied and pasted from the records into a blank Word document. Mr Scott further states that it was "never established" whether Ms Begum had printed any documents from the system or if she prepared a Word document which contained information extracted from the records and that "It may well be that she took photographs of the information on her personal mobile phone". Mr Scott based this last comment on the fact that Claimant had said in the course of her contact with the Defendant that her husband had pictures of her information. Finally, for reasons which he explains, involving encryption of USB drives and audit trails of the same, Ms Begum could not have downloaded information onto a USB drive.[12]While these matters were being investigated, Ms Begum was denied access to the Defendant's IT system. In light of what was discovered about her conduct, Ms Begum was dismissed, and, further, was arrested and charged with one offence of unauthorised access to computer material, contrary to section 1 of the Computer Misuse Act 1990. On 13 October 2020, following her conviction on her own plea of guilty, she was sentenced at Luton Crown Court to 3 months' imprisonment, suspended for 12 months, together with 150 hours of unpaid community service. In passing sentence, Her Honour Judge Mensah referred to and endorsed the comments of Ms Begum's line manager at the material time that her conduct was "deliberate, planned and goes against every professional code of conduct we adhere to and… put the family at risk of harm".[13]In addition to the witness statement of Mr Scott, the Defendant served witness statements of Leigh Jolly, the Defendant's head of IT, and Diane Rushby, who is employed by the Defendant as head of service for the multi-agency safeguarding hub and family partnership service of the Defendant, which incorporates the Manor Family Resource Centre where Ms Begum was employed as a Contact Assessment Worker.[14]Ms Rushby exhibits and refers to a statement of Jane Brown, who was the manager of that Centre at the time when Ms Begum was employed there, which was made as part of the criminal proceedings against Ms Begum. Ms Rushby agrees with Ms Brown's evidence that Ms Begum's actions in accessing the files relating to the Claimant (and the children) was contrary to the Defendant's professional code of conduct and the ethos of Ms Begum's role as a worker at that Centre. Ms Brown further explains that the office in which Ms Begum worked was equipped with computer terminals which were accessed by staff on a hot desk basis, that Ms Begum used to sit on the end of a bank of three desks in the middle of the office where people could see what she was doing and her computer screen was visible to passers-by, and that a couple of months before the incident in question came to light she moved to sit in the corner by the window where nobody could see her screen or what she was doing. This did not cause Ms Brown to suspect that Ms Begum was doing anything wrong, although she found it strange.[15]The Defendant's evidence establishes the following:(1) Permission to view Liquid Logic records is not allocated on an individual basis, but rather is based on each employee's role.(2) Contact centre workers are responsible for supervising contact for looked after children and can provide targeted parenting support. They also write notes on the contacts taking place and may provide contact reports if requested by the court.(3) In order to fulfil their roles, contact centre workers require unrestricted access to the system, for a number of reasons: First, they may be required to fulfil a contact request for a new file at short notice. If access were generally restricted, this would involve additional form filling, administrative support and delays. To gain access to a file if a general restriction were in place, a contact centre worker would need to request authorisation from their line manager, which would then need to be agreed by a Head of Service. The request would then go through to the IT department who have a turnaround or 3 to 5 days. The process of authorisation would therefore likely take around 6 days for each request. Restricted access would be highly impractical. Second, a contact centre worker may overhear information about other individuals whilst supervising a contact. The worker may then need to quickly access the records to see if the individual mentioned had an open file and gain contact with their social worker if necessary. If access was restricted to a worker's own cases they would not be able to do this, which could cause potential safeguarding issues. Third, when a colleague is off sick or cannot attend a meeting, a contact centre worker will need to cover that colleague's case. This will involve accessing a colleague's files at short notice in order to gain details of the case. If access was restricted to each worker's cases this would prevent effective management of cases.(4) Ms Begum's level of access accorded with standard practice, for the above reasons.(5) Individual records are only restricted by locking if a specific need to do so arises, as was the case once the breach which has led to the present claim came to light.(6) The Social Care case management records within Liquid Logic are restricted in that only those people who work within Social Services can access the records. Some partner organisations, such as the NHS, may have access to the records but that access is equally controlled by appropriate security boundaries and permissions.(7) Each individual who joins Social Services receives training on Liquid Logic. It is made clear within induction and training that access is audited and that they should only ever access records as required. There is no ambiguity at all in this regard.(8) All contact centre workers are made aware that they should notify their line managers if they have a personal connection to any clients on the system. Their access to these cases is then restricted. Ms Begum would have been aware of the need to inform her line manager of her connection to the Claimant (i.e. by reason of her relationship with the Claimant's husband). If Ms Begum had followed the correct process, her access to the Claimant's files would have been restricted.(9) Throughout her induction and on a regular basis Ms Begum would have received data protection and GDPR training. She did in fact receive data protection training on 20 April 2016 and GDPR training on 16 May 2018. The requirement to access files only as necessary is something which is reiterated regularly at service meetings and team meetings. The importance of not accessing case files unless necessary could also be expected to be covered at one-to-one supervision meetings. Such meetings take place around once a month for contact centre workers.(10) Although in light of her role it was necessary for Ms Begum to have required elevated levels of access within Liquid Logic, as that would have been crucial to her work, in this instance she accessed records when she had no need to do so. That was an unlawful accessing of records. She clearly knew that what she was doing was wrong, as borne out by the fact that she pleaded guilty to a criminal offence.(11) Liquid Logic is set up to operate by the Defendant in exactly the same way in other Local Authorities across the country. As far as is known, in other Local Authorities access is not restricted on a case by case or worker by worker basis once it is established that an individual within the role requires access to Liquid Logic. Other Local Authorities do not lock down the systems for Contact Assessment Workers.(12) The Defendant could not have done anything differently or included anything within its systems to have prevented what Ms Begum did.[16]These points are borne out or amplified by the contents of extensive exhibits, which include the following documents of the Defendant:(i) Human Resources Security Standards dated January 2010,(ii) Code of Conduct for Employees,(iii) policies referred to at Section 2.2.2.3 of the Human Resources Information Security Standards dated January 2010, and(iv) Legal responsibilities policy. Further, the log in screen contains a number of warnings regarding the fact that log ins are subject to audit and GDPR requirements generally: when logging on, an individual is required to make their way through three screens to enter their log-in, then enter their password and then answer a security question, and the warnings remain in place on all three screens. THE RELEVANT LEGAL PRINCIPLES[17]In Morrison payroll data was provided by his employer to an internal auditor, Andrew Skelton, for the sole purpose of passing it on to the external auditors. Although Mr Skelton carried out that task, he also unlawfully copied the data and uploaded it onto a publicly accessible website. His motive was to cause harm to his employer, because he bore a grudge against it. In furtherance of that objective, on the day when the employer's financial results were due to be announced, Mr Skelton also sent the data to a number of national newspapers. Other employees whose personal data had thus been disclosed brought claims against the employer for breach of confidence and misuse of private information on the basis that the employer was vicariously liable for Mr Skelton's wrongdoing. Those claims succeeded before Langstaff J, and the Court of Appeal upheld that decision, but that outcome was reversed in the Supreme Court.[18]Lord Reed PSC reviewed the authorities on vicarious liability. At [22] Lord Reed referred to the judgment of Lord Nicholls in Dubai Aluminium Co Ltd v Salaam [2003] 2 AC 366 . At [23] Lord Reed stated that Lord Nicholls had identified the general principle applicable to vicarious liability arising out of a relationship of employment as being that which I have already cited in [2] above:
"… the wrongful conduct must be so closely connected with acts the employee was authorised to do that, for the purposes of the liability of the employer to third parties, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment"
. At [24] Lord Reed said:
"The general principle set out by Lord Nicholls in Dubai Aluminium , like many other principles of the law of tort, has to be applied with regard to the circumstances of the case before the court and the assistance provided by previous court decisions. The words 'fairly and properly' are not, therefore, intended as an invitation to judges to decide cases according to their personal sense of justice, but require them to consider how the guidance derived from decided cases furnishes a solution to the case before the court. Judges should therefore identify from the decided cases the factors or principles which point towards or away from vicarious liability in the case before the court, and which explain why it should or should not be imposed. Following that approach, cases can be decided on a basis which is principled and consistent."
[19]At [31], Lord Reed explained why the trial judge and the Court of Appeal had misunderstood the principles governing vicarious liability in a number of relevant respects. These included:(1) that the disclosure of the data on the internet did not form part of Mr Skelton's functions or field of activities, in the sense in which those words had been used by Lord Toulson JSC in Mohamud v Wm Morrison Supermarkets plc [2016] AC 677 ; it was not an act which Mr Skelton was authorised to do, as Lord Nicholls put it;(2) the fact that the 5 factors listed by Lord Phillips in Various Claimants v Catholic Child Welfare Society [2013] 2 AC 1 at [35] existed was nothing to the point;(3) although there was a close temporal link and an unbroken chain of causation linking the provision of the data to Mr Skelton for the purpose of transmitting it to the external auditors and his disclosing it on the internet, a temporal or causal connection does not in itself satisfy the close connection test; and(4) the reason why Mr Skelton acted wrongfully was not irrelevant, but, on the contrary, it was "highly material" whether he was acting on his employer's business or for purely personal reasons.[20]When considering afresh the question of whether the employer was vicariously liable for Mr Skelton's wrongdoing, at [33] Lord Reed posed the question of whether Mr Skelton's wrongful disclosure of the data was "so closely connected with the collation and transmission of the data to [the external auditors] that, for the purposes of the liability of his employer to third parties, the disclosure may fairly and properly be regarded as made by him while acting in the ordinary course of his employment."[21]At [35], Lord Reed stated that the mere fact that Mr Skelton's employment gave him the opportunity to commit the wrongful act would not be sufficient to warrant the imposition of vicarious liability, and then said of the approach that Mr Skelton's disclosure of the data on the internet was "closely related to what he was tasked to do":
"… The fallacy in that approach was explained by Lord Wilberforce in Kooragang Investments Pty Ltd v Richardson & Wrench Ltd [1982] AC462, which concerned an employee who was authorised to carry out valuations, and negligently carried out a valuation without authority from his employers and not on their behalf. Lord Wilberforce rejected the argument that so long as the employee is doing acts of the same kind as those which it is within his authority to do, the employer is liable, and is not entitled to show that the employee had no authority to do them. He said at p 473: the underlying principle remains that a servant, even while performing acts of the class which he was authorised, or employed, to do, may so clearly depart from the scope of his employment that his master will not be liable for his wrongful acts."
[22]At [36] Lord Reed explained that "in applying the close connection test it is necessary to have regard to the assistance provided by previous court decisions". He continued:
"37 The basic principle normally applicable to cases where an employee is engaged in an independent personal venture was explained in Joel v Morison (1834) 6 C&P501, which concerned a claim for personal injuries brought by a plaintiff who had been knocked down by a cart driven by the defendant's employee. Parke B said at p 503: The master is only liable where the servant is acting in the course of his employment. If he was going out of his way, against his masters implied commands, when driving on his master's business, he will make his master liable; but if he was going on a frolic of his own, without being at all on his master's business, the master will not be liable. 38 More recently, the issue of liability for acts performed by an employee in the course of an independent venture of his own was considered by Lord Nicholls in Dubai Aluminium [2003] 2 AC 366 , para 32: A distinction is to be drawn between cases such as Hamlyn v John Houston & Co [1903] 1 KB 81 , where the employee was engaged, however misguidedly, in furthering his employer's business, and cases where the employee is engaged solely in pursuing his own interests: on a "frolic of his own", in the language of the time-honoured catch phrase . . . The matter stands differently when the employee is engaged only in furthering his own interests, as distinct from those of his employer. Then he acts as to be in effect a stranger in relation to his employer with respect to the act he has committed: see Isaacs J in Bugge v Brown (1919) 26 CLR 110, 118."
[23]Having reviewed a number of other authorities for the purpose of considering such facts as may give rise to a claim in vicarious liability, Lord Reed concluded at [47]:
"All these examples illustrate the distinction drawn by Lord Nicholls at para 32 of Dubai Aluminium [2003] 2 AC 366 between 'cases … where the employee was engaged, however misguidedly, in furthering his employer's business, and cases where the employee is engaged solely in pursuing his own interests: on a "frolic of his own", in the language of the time-honoured catch phrase.' In the present case, it is abundantly clear that Skelton was not engaged in furthering his employer's business when he committed the wrongdoing in question. On the contrary, he was pursuing a personal vendetta, seeking vengeance for the disciplinary proceedings some months earlier. In those circumstances, applying the test laid down by Lord Nicholls in Dubai Aluminium in the light of the circumstances of the case and the relevant precedents, Skelton's wrongful conduct was not so closely connected with acts which he was authorised to do that, for the purposes of Morrisons' liability to third parties, it can fairly and properly be regarded as done by him while acting in the ordinary course of his employment."
[24]Mr Clarke drew my attention to a number of other decided cases, including Lister v Hesley Hall Ltd [2002] 1 AC 215 , which concerned the sexual abuse of children by the warden of a school boarding house. Mr Clarke relied on the following statement in that case by Lord Millett at [79]:
"So it is no answer to say that the employee was guilty of intentional wrongdoing, or that his act was not merely tortious but criminal, or that he was acting exclusively for his own benefit, or that he was acting contrary to express instructions, or that his conduct was the very negation of his employer's duty."
[25]In my judgment, however, this statement must be read in context. Lord Millett's propositions are far from being open ended, as the remainder of [79] makes clear:
"The cases show that where an employer undertakes the care of a client's property and entrusts the task to an employee who steals the property, the employer is vicariously liable … Experience shows that the risk of theft by an employee is inherent in a business which involves entrusting the custody of a customer's property to employees. But the theft must be committed by the very employee to whom the custody of the property is entrusted. He does more than make the most of an opportunity presented by the fact of his employment. He takes advantage of the position in which the employer has placed him to enable the purposes of the employer's business to be achieved. If the boys in the present case had been sacks of potatoes and the defendant, having been engaged to take care of them, had entrusted their care to one of its employees, it would have been vicariously liable for any criminal damage done to them by the employee in question, though not by any other employee. Given that the employer's liability does not arise from the law of bailment, it is not immediately apparent that it should make any difference that the victims were boys, that the wrongdoing took the form of sexual abuse, and that it was committed for the personal gratification of the employee."
[26]Lord Millett's reference to the need, if vicarious liability is to be imposed, for the wrongdoing to be carried out by "the very employee to whom the custody of the property is entrusted" on the basis that such an employee "does more than make the most of an opportunity presented by the fact of his employment" and instead "takes advantage of the position in which the employer has placed him to enable the purposes of the employer's business to be achieved" is echoed in, and indeed appears to be derived from, another of the cases to which I was referred by Mr Clarke, namely Morris vCW Martin & Sons Ltd [1966] 1 QB 716. Lord Millett provided the following synopsis of that case in Lister v Hesley Hall Ltd [2002] 1 AC 215 at [76]:
"… a firm of cleaners was held vicariously liable to a customer whose fur was stolen by one of its employees. The firm was a sub-bailee for reward, but the decision was not based on the firm's own failure to take care of the fur and deliver it upon termination of the bailment. It was held vicariously liable for the conversion of the fur by its employee. Diplock LJ said, at p. 737, that he based his decision: "on the ground that the fur was stolen by the very servant whom the defendants as bailees for reward had employed to take care of it and clean it" (my emphasis). Salmon LJ too, at p 740, was anxious to make it plain that the conclusion which he had reached depended on the fact that the thief was "the servant through whom the defendants chose to discharge their duty to take reasonable care of the plaintiff's fur."
He added, at pp 740-741, that "A bailee for reward is not answerable for a theft by any of his servants but only for a theft by such of them as are deputed by him to discharge some part of his duty of taking reasonable care. A theft by any servant who is not employed to do anything in relation to the goods bailed is entirely outside the scope of his employment and cannot make the master liable." The employee's position gave him the opportunity to steal the fur, but as Diplock LJ was at pains to make clear, at p. 737, this was not enough to make his employer liable. What brought the theft within the scope of his employment and made the firm liable was that in the course of its business the firm had entrusted him with the care of the fur, and he stole it while it was in his custody as an employee of the firm."[27]In Morrison , Lord Reed referred at [23] to the fact that "the close connection test has been applied differently in cases concerned with the sexual abuse of children, which cannot be regarded as something done by the employee while acting in the ordinary course of his employment" and where, instead, "the courts have emphasised the importance of criteria that are particularly relevant to that form of wrongdoing, such as the employer's conferral of authority on the employee over the victims, which he has abused". In my view, the passages from Lister relied on by Mr Clarke bear this out. Moreover, although this area of the law is certainly not without difficulties, it seems to me that this is a principled approach, and, indeed, as Lord Millett explains, one which is not novel but instead accords with that taken in cases involving custody of chattels.[28]Mr Clarke's main additional line of argument begins with Lord Steyn's reference in Lister at [27] to the "luminous and illuminating judgments" of the Canadian Supreme Court in Bazley v Curry 174 DLR(4th) 45 and Jacobi v Griffiths 174 DLR(4th) 71 and his suggestion concerning the issues associated with the principle of vicarious liability that "Wherever such problems are considered in future in the common law world these judgments will be the starting point". In support of his argument that the principles enunciated in these cases are not confined to cases of sexual abuse, Mr Clarke pointed out that they had recently been applied by the Court of Appeal in a different context.[29]Mr Clarke placed particular reliance on McLachlin J's consideration of the principles of vicarious liability in Bazley at [41] and [42] as follows:
"41. Reviewing the jurisprudence, and considering the policy issues involved, I conclude that in determining whether an employer is vicariously liable for an employee's unauthorized, intentional wrong in cases where precedent is inconclusive, courts should be guided by the following principles: (1) They should openly confront the question of whether liability should lie against the employer, rather than obscuring the decision beneath semantic discussions of 'scope of employment' and 'mode of conduct'. (2) The fundamental question is whether the wrongful act is sufficiently related to conduct authorized by the employer to justify the imposition of vicarious liability. Vicarious liability is generally appropriate where there is a significant connection between the creation or enhancement of a risk and the wrong that accrues therefrom, even if unrelated to the employer's desires. … (3) In determining the sufficiency of the connection between the employer's creation or enhancement of the risk and the wrong complained of, subsidiary factors may be considered. When related to intentional torts, the relevant facts may include, but are not limited to the following: (a) the opportunity that the enterprise afforded the employee to abuse his or her power; (b) the extent to which the wrongful act may have furthered the employer's aims (and hence be more likely to have been committed by the employee); (c) the extent to which the wrongful act was related to friction, confrontation or intimacy inherent in the employer's enterprise; (d) the extent of power conferred on the employee in relation to the victim; (e) the vulnerability of potential victims to wrongful exercise of the employee's power. 42. Applying these general considerations to sexual abuse by employees, there must be a strong connection between what the employer was asking the employee to do (the risk created by the employer's enterprise) and the wrongful act. It must be possible to say that the employer significantly increased the risk of the harm by putting the employee in his or her position and requiring him to perform the assigned tasks. … an incidental or random attack by an employee that merely happens to take place on the employer's premises during the working hours will scarcely justify holding the employer liable. Such an attack is unlikely to be related to the business the employer is conducting or what the employee was asked to do and, hence, to any risk that was created. Nor is the imposition of liability likely to have a significant deterrent effect; short of closing the premises or discharging all employees, little can be done to avoid the random wrong. Nor is foreseeability of harm used in negligence law the test. What is required is a material increase in the risk as a consequence of the employer's enterprise and the duties he entrusted to the employee, mindful of the policies behind vicarious liability."
[30]In Chell v Tarmac Cement and Lime Ltd [2022] EWCA Civ 7 these principles were applied by the judge at first instance when considering the issue of vicarious liability. In that case the claimant was employed by a company ("R") as a site fitter at a site which was operated and controlled by the defendant ("Tarmac"). The claimant was providing services for the purposes of Tarmac's business. On the date in question, a fitter employed by Tarmac, ("H"), entered the workshop on that site, and when the claimant bent down to pick up a length of cut steel, H put two pellet targets on the bench close to the claimant's right ear and hit them with a hammer causing a loud explosion next to the claimant's right ear. As a result of this, the claimant suffered personal injury, including noise induced hearing loss and tinnitus. Noting that these principles had been applied by the court below when determining whether Tarmac was vicariously liable for H's acts, and that no point was taken on the fact that the case was not a case of sexual abuse, the Court of Appeal applied these principles as well. The judge dismissed the claim based on vicarious liability. The Court of Appeal upheld that decision.[31]Mr Clarke's central proposition was that it would be appropriate to apply the factors set out at [41(3)] of Bazley to the facts of the present case, and that this exercise supports the conclusion that the Defendant is vicariously liable for the actions of Ms Begum.[32]For his part, Mr Harding did not accept that argument, or that these factors, if applicable, would result in success for the Claimant. As noted above, his main contention is that the answer to the issue of vicarious liability in the present case is provided by application of the guidance set out in Morrison alone. This includes the need to compare the circumstances of this case with those of other decided cases in order to assess how much assistance is provided by previous court decisions. In that regard, he submitted that the facts and outcome of Morrison are both highly pertinent.[33]Mr Harding submitted that the following principles can be distilled from Morrison :(1) In a case concerned with vicarious liability arising out of a relationship of employment, the test is whether the wrongful conduct was so closely connected with acts the employee was authorised to do that, for the purposes of the liability of his employer, it may fairly and properly be regarded as done by the employee while acting in the ordinary course of his employment.(2) Cases involving sexual abuse have followed a different approach, and focus on different factors, such as misuse or abuse of authority over the victims, over whom the perpetrator has some element of responsibility or trust.(3) Applying the test in (1) above, the critical distinction is between cases where, on the one hand, the employee was engaged, however misguidedly, in furthering his employer's business, and cases where the employee is engaged solely in pursuing his own interests: on a 'frolic of his own'.(4) The motive of the tortfeasor is a highly relevant factor. If they are acting for 'personal' reasons this is a strong indication that they are not purporting, even misguidedly, to further their employer's business.(5) The fact that employment provided a tortfeasor with the opportunity (for example, in terms of access to the information) to commit the wrongful act is never sufficient to establish vicarious liability. The focus should not be on the fact that there is close temporal or causal connection between the work and the wrongdoing. It will almost always be true that the wrongdoing has occurred against the background of the employment and whilst the employee is 'at work'. However, it is a 'fallacy' to think that simply because the wrongdoing occurs whilst the employee is performing acts of 'the class of which he was authorised', it is thereby sufficiently closely connected to it. If the employee acts for personal reasons, rather than purporting to further the employee's business, it may well be the case that they have so clearly departed from the scope of their employment that the employer will not be vicariously liable.[34]As an illustration of this last proposition, Mr Harding relied on Irving v Post Office (1987) IRLR 289. In that case, the duties of a post office employee included the sorting of mail at his depot, and the delivering of mail on his round, which involved going to his District Office to sort mail preparatory to delivering it. While at work, he saw an envelope addressed to his immediate neighbours, with whom he had fallen out. He did not deliver to the district where his neighbours lived, and normally he would not have come across mail addressed to them. The letter in question had inadvertently been mis-sorted. His duty was to put it into the mis-sort box. Before he did so, he wrote on the back of the envelope a racial remark and added a cartoon of a smiling mouth and eyes.[35]The central issue in that case was whether the Post Office was vicariously liable for the act of the employee. The claim was brought by his neighbours, who contended that it was, and that his conduct was an act of discrimination against them under section 1(1) of the Race Relations Act, 1976, and actionable accordingly. The judge at first instance held that the employee, when he wrote the abusive words, was not acting in the course of his employment, and that the claim accordingly failed. The Court of Appeal agreed.[36]Fox LJ said:
"The doctrine of vicarious liability is necessary for the reasonable protection of innocent third parties. But out of fairness to employers, limits have to be set to it. That is, perhaps, more particularly evident in a case such as the present where the Post Office is sought to be made liable for the wilful wrongdoing of Edwards, which the Post Office in no way authorised. In my judgment, what Edwards did was an act which cannot be regarded as being merely an unauthorised way of performing the duties for which he was employed, namely, to sort and deliver mail. Out of personal malevolence to the addressees (or one of them) he wrote an offensive message on the envelope. That was not the performance of any duty for which he was employed. His employment provided the opportunity for his misconduct, but the misconduct formed no part of the performance of his duties and was in no way directed to the performance of those duties. It was just a piece of spite on the spur of the moment. He was, of course, authorised for postal purposes to write upon envelopes, but what he wrote, and the purpose of what he wrote, had no connection with the performance of his duties."
[37]Sheldon J said:
"… [Counsel] submitted that as the "job upon which Mr Edwards was engaged" at the material time was that of sorting mail, his act in writing on the envelope — albeit not merely unauthorised but expressly prohibited — was within the scope of that employment. As I understand the argument, it was to the effect that the time spent by Mr Edwards in writing his comments would have been so short, such a minor interruption in the overall legitimate process of sorting the mail, that it should all be treated as part of one transaction: and that to differentiate it, in this respect, from actions that immediately preceded and followed it, would be unrealistic and amount to the very process of dissection that Diplock LJ was discouraging [i.e. in Ilkiw v Samuels & Ors. (1963) 1 WLR 991 at 1004]. In my judgment, however, such an argument demonstrates the danger of taking passages out of context, and begs the question: whether Mr Edwards act in writing on that envelope, however short the time that it took, was in fact part of the process of sorting the mail and was within the scope of his employment. In the event, in my judgment, the Tribunal's finding that to write that offensive message on the envelope addressed to the plaintiffs was no part of the work that Mr Edwards was employed to do is not open to criticism; on the contrary, in my view it was plainly right. On the facts, indeed, to have found otherwise would have been to import the proposition which Heasmans [i.e. Heasmans v Clarity Cleaning Co. Ltd , The Times, 23 January 1987 — in which it was held by the Court of Appeal that a cleaning contractor engaged to clean offices was not vicariously liable for the tort of its employee, whose duties included cleaning the office telephones, in dishonestly using the telephones for his own purposes]; and the Keppel Bus Co. Ltd. [i.e. Keppel Bus Co. Ltd. v. Sa'ad bin Ahmad (1974) 1 WLR 1082 , in which the employers were held not to be liable for a violent assault by a bus conductor upon a passenger in his bus] cases (inter alia) have shown to be wrong."
[38]In those passages, as it seems to me, Sheldon J was addressing an argument very similar to the "field of activities" test which Mr Clarke invited me to apply in the present case. DISCUSSION[39]While I have every sympathy for the Claimant and the predicament in which she was placed by Ms Begum's acts, I have little hesitation in holding that the claim based on vicarious liability is not made out, essentially for the reasons advanced by Mr Harding.[40]In this case, as was also true of the employee in Morrison , in carrying out the acts upon which the claim is based Ms Begum was in no way engaged, whether misguidedly or not, in furthering the business of her employer, the Defendant.[41]Although Ms Begum gained the opportunity to access and process data relating to the Claimant (and the children) by reason of the unrestricted access to the Liquid Logic system which she was required to be afforded in order to perform her role as a contact centre worker, it formed no part of any work which she was engaged by the Defendant to do to access or process those particular records. Indeed, if Ms Begum had disclosed her connection with the Claimant's husband, as she ought to have done, her access to these records would have been restricted by the Defendant.[42]In doing what she did, Ms Begum was engaged solely in pursuing her own agenda, namely divulging information to the Claimant's husband, with whom she had some relationship. Further, that was to the detriment of the Claimant (and the children) whose safety and interests as users of the Defendant's services it formed part of Ms Begum's core duties to further and protect.[43]This was, in my judgment, a classic case of Ms Begum being on a "frolic of her own".[44]In terms of comparison with the facts of Morrison , in my opinion it matters not that Ms Begum's particular "frolic" took the form that it did, as opposed to taking the form of a vendetta against her employer.[45]In fact, as already discussed, the present case is stronger from the Defendant's point of view, because Mr Skelton was engaged in using unlawfully data which he had been tasked with processing lawfully, whereas in the present case Ms Begum was not tasked in any shape or form with either accessing or disseminating the information in question.[46]Nor, in my judgment, does the safeguarding element of Ms Begum's job assist the Claimant's case. Indeed, in my view that feature merely serves to underline how plainly Ms Begum was not engaged in furthering the business of the Defendant, but was instead engaged in furthering her own ends, in contradiction to those of the Defendant.[47]In those circumstances, applying the authoritative test laid down in Morrison in the light of the circumstances of this case and the relevant case law, Ms Begum's wrongful conduct was not so closely connected with acts which she was authorised to do that, for the purposes of the Defendant's liability to third parties, it can fairly and properly be regarded as done by her while acting in the ordinary course of her employment.[48]On that basis, I do not consider that it is necessary to consider the factors set out in Bazley at [41(3)]. In this regard, I observe that Bazley was cited in argument in Morrison , but is not referred to in the judgment of Lord Reed. If, contrary to the foregoing, these factors call for separate consideration, my brief views are as follows:(a) The Defendant did afford Ms Begum the opportunity to abuse her position. However, that is almost always the case in any instance of employee abuse of position; it is not sufficient by itself to give rise to vicarious liability; and, on the unchallenged evidence before me, the Defendant could not have done otherwise.(b) Ms Begum's wrongful acts did not in any way further the employer's aims. They were not more likely to have been committed by the employee for this reason.(c) Ms Begum's wrongful acts were not related to friction, confrontation or intimacy inherent in the Defendant's enterprise. This factor seems to me most readily applicable in cases of physical interaction between employees or interaction between the individual tortfeasor and a third party or third parties, such as occurs in (but may not be limited to) the sexual abuse cases, and this was not such a case.(d) Like considerations apply to the question of the extent of power conferred on the employee in relation to the victim. This seems to me most readily applicable in cases involving (typically physical) interaction with the victim. If and to the extent that it applies to the employer permitting the employee to access information relating to a victim, the Defendant did not confer power on Ms Begum to access the Claimant's information: Ms Begum took advantage of the opportunity which the Defendant's working practices necessarily afforded to her to do that improperly, surreptitiously and for her own purposes, which had nothing to do with any role or authority which the Defendant assigned to her vis-à-vis the Claimant.(e) It seems to me that the vulnerability of potential victims to wrongful exercise of the employee's power could be relevant with regard to someone like Ms Begum if she was put in charge of dealing with a particular service user, perhaps in the context of arranging contact. I am prepared to assume that such service users, or at least some of them, may well be vulnerable in this way. However, Ms Begum was never put in charge of any aspect of the affairs of the Claimant (or the children), or indeed information relating to them. I do not consider that this factor assists the Claimant. CONCLUSION[49]For all these reasons, this claim fails and must be dismissed.[50]I ask Counsel to agree an order which reflects the above. I will deal with submissions on any points which remain in dispute as to the form of the order, any other issues such as costs and permission to appeal, either (if Counsel agree) on the basis of written submissions, or when judgment is handed down or if that is not possible on an adjourned hearing on some convenient date. If permission to appeal is in issue, I would intend that the time for seeking permission to appeal should not start running in the meantime.

Cited in 2 later judgments