Most people and therefore most employers probably think that they are liable only for the direct authorised acts of their employees. Put simply, this means acts and omissions when they are doing their work for you – the work you have asked them to do. 

So in that context the long-awaited judgment from the Court of Appeal that Morrisons is liable for a malicious data leak by a disgruntled employee is probably a bit of a wake-up call. It is one thing carrying the can for what an employee was supposed to be doing, but quite another when they are intentionally doing something they are not supposed to do. 

The reality of course is most employer liability will stem from accidents or errors or omissions during the scope of lawful activities. So it is worth noting why Morrisons came so unstuck when the act was unlawful and unauthorised.  

“It is one thing carrying the can for what an employee was supposed to be doing, but quite another when they are intentionally doing something they are not supposed to”

…