[BreachExchange] Employers Can Be Vicariously Liable for Employee Data Breaches

[Destry Winant]

https://www.natlawreview.com/article/employers-can-be-vicariously-liable-employee-data-breaches

The United Kingdom High Court recently issued a landmark liability
judgment against the supermarket, Morrisons, following a data breach
caused by a rogue employee (Various Claimants v. WM Morrisons
Supermarket [2017] EWHC3113 (QB]).Similar results have been reached in
the U.S., but this is the first time the UK Court has addressed the
issue of whether an employer can be held vicariously liable under the
UK’s Data Protection Act 1998 (DPA) (c 29) for a data breach committed
by an employee. These kinds of cases are important reminders that
irrespective of jurisdiction, malicious insiders, in particular
disgruntled former employees, with access to data that external
hackers can’t easily reach, often cause some of the most costly data
breaches.

Morrisons

The press, in 2014, discovered that a Morrisons payroll file
containing personal data of nearly 100,000 employees was uploaded to a
public website. The employee personal data exposed included names,
addresses, dates of birth, ID numbers, bank account information and
salaries. Once Morrisons became aware of the breach, the supermarket
took prompt action, removing the personal data from the website and
cooperating with the public authorities and banks.

The payroll data was intentionally exposed by a senior IT auditor of
Morrisons, Andrew Skeleton, who copied the data onto his personal USB
before supplying the information to the supermarket’s external
auditor. Skeleton allegedly acted in defiance against Morrisons due to
a disciplinary incident from earlier in the year.

Consequently, in 2015 a UK county court convicted Skeleton of fraud,
disclosing personal data and securing unauthorized access to computer
matter, and sentenced him to eight years in prison pursuant to the DPA
and the Computer Misuse Act 1990 (c 18).

Two years later, over 5000 employees brought a class action against
Morrisons alleging that the supermarket breached it statutory duty
under the DPA and at common law for breach of confidence and misuse of
private information. The claimants contended that Morrisons was
directly liable for breaching its statutory duty, and alternatively
that it was vicariously liable for the breach as Skeleton’s employer.

Under the DPA, as a data controller Morrisons is required to comply
with certain data principles among which include ensuring that ‘data
shall be processed in accordance with the rights of data subjects’
(principle 6), and ‘appropriate technical and organizational measures
shall be taken against unauthorized or unlawful processing of personal
data’ (principle 7).

In respect to direct liability, the UK High Court held that Morrisons
could not be directly liable as it had not breached the principles
under the DPA, and had not breached the confidentiality of its
employees or misused information.

Conversely, in respect to vicarious liability, the Court concluded
that Morrisons could be liable for Skeleton’s actions on the basis
that ‘there was a sufficient connection between the position in which
Mr. Skeleton was employed and his wrongful conduct’.

Similar Cases in the U.S.

In the U.S., the doctrine of respondeat superior provides that an
employer may be vicariously liable for the tortious acts of one of its
employees, which generally applies only when the employee’s acts were
committed in furtherance of the employer’s business and within the
scope of employment. However, applying this rule to similar
circumstances may yield different results.

In Doe v. Guthrie Clinic, Ltd., a nurse recognized that one of her
employer’s patients being treated for a sexually transmitted disease
(STD) was the boyfriend of her sister-in-law. The nurse accessed the
patient’s medical records, confirmed he was being treated for the STD,
and texted her sister-in-law about her boyfriend’s condition. The New
York Court of Appeals held the employer medical corporation not liable
because the employee’s action was not within the scope of her
employment.

However, an Indiana appellate court upheld a $1.44M jury verdict
holding a big box pharmacy liable for the actions of one of its
employees, a pharmacist. In that case, the pharmacist improperly
accessed the prescription history (birth control medication) of a
patient who once dated the pharmacist’s husband. Here, conduct not
unlike the facts in the Doe v. Guthrie Clinic, Ltd. case, was found by
the jury and upheld by the court to be sufficient which the scope of
employment.

Employer Takeaways

While the actions of a rogue employer can be unpredictable, there are
steps employers can take to minimize risks associated with insider
threats. Steps include:

- performing thorough and relevant background checks and periodically
assessing employee behavior once hired;
- straight forward employee policies and training;
- systems that can limit access to data to the extent appropriate for
the business and applicable law – even though an authorized user can
abuse their access as in Morrisons, limiting access allows an employer
to pinpoint who accessed sensitive data in the case of an incident;
- ensuring best practice for account protection (e.g. frequently
changing password, unique and strong passwords)
- acting promptly and effectively if an incident occurs.

With the looming EU General Data Protection Regulation (GDPR) that
will heighten data privacy and security obligations for employers both
based within the EU and outside of it (see our article Does the GDPR
Apply to Your US-based Company?), companies should be assessing their
data security measures to ensure GDPR compliance, which will in turn
minimize the risks associated with insider threats.