2 notable legal judgements have sounded a note of caution for both employers and employees.
INJURY TO FEELINGS COMPENSATION
UK employee was awarded £42,809 by an Employment Tribunal (ET) for ‘injury to feelings’ compensation alone, as part of a £386,000 award for race and age discrimination, harassment and victimisation.
The employee had been working for her employer for just a month before being medically signed-off for stress and depression resulting from work-related incidents targeted against her. The ET upheld 12 of the 19 complaints of direct discrimination, victimisation and harassment relating to race and or age and it found that the employer’s staff had deliberately created a “hostile environment”. Managers also breached her confidence when she reported being bullied.
The case attracted particular attention because the injury to feelings award was close to the upper limit of the top bracket (known as “Vento” bands). The highest of the three range brackets for Injury to Feelings is £27,000-£45,000.
DELIBERATE DATA BREACH BY AN EMPLOYEE
Can an employer be liable for a deliberate data breach by a disgruntled employee ?
This case ran through the UK courts for 6 years.
It revolved around an employee who intentionally leaked the personal data of thousands of his colleagues’ personal data which led to 9,263 of those colleagues bringing a claim against their employer under the Data Protection Act 1998.
They alleged that their employer was either directly or vicariously liable for the disgruntled employee’s actions. Employers can be liable for such acts committed by an employee, if there is a sufficient connection between the employment and the wrongdoing.
The employee was an IT internal auditor and in the course of his duties he transferred payroll data of nearly 100,000 employees to the company’s auditors, and also downloaded a copy for his own personal use.
He subsequently uploaded the payroll data to a public file sharing website. The data disclosed included employees’ names, addresses, telephone numbers and bank details. He then sent the information to newspapers, one of which contacted the employer, which took immediate action to remove the online data and they informed the police.
The employee received an 8-year prison sentence and the employer spent over £2.26m managing the aftermath of the breach.
The employer initially lost the employees’ data breach claim in the High Court and then in the Court of Appeal, who found that the employer was vicariously liable for the employee’s conduct, whether for breach of statutory duty under the Data Protection Act, tortious misuse of private information or breach of confidence in equity.
Supreme Court Appeal
However, the company’s lawyers then took the case to the Supreme Court and argued that the firm was “entirely blameless” and would be exposed to “compensation claims on a potentially vast scale” if the decision stood. The Supreme Court overturned the earlier court decisions and unanimously held that the employee did not act in the ordinary course of his employment.
The fact that his employment gave him the opportunity to commit wrongdoing was not sufficient to make the employer vicariously liable because the employee was pursuing a personal grudge outside their field of activities for their employer.