Speaker #0Today in the Indicator HR and Employment Law podcast, we're discussing the judgment in the case of JXK and another and the Chief Constable of Greater Manchester Police, in which the High Court was asked to consider whether a police force was responsible for the unlawful behaviour of one of its constables relating to access it provided him to individuals' personal data. P, while working as a serving police officer, accessed and misused personal data relating to J and disclosed data belonging to third parties to B. P was convicted in a criminal court of offences under the Data Protection and Computer Misuse legislation after entering a guilty plea, and J and B brought civil proceedings against the Chief Constable of Greater Manchester Police, GMP, in relation to P's offences and the harm it had caused them. While GMP acknowledged that the allegations raised by J and B in the civil claim were serious, and that both had suffered greatly due to P's actions, it maintained that J and B had failed to set out reasonable grounds for bringing their claim, and that it should be struck out. In particular, GMP argued that it was not vicariously liable for P's actions as, at all times, P had acted in a manner that was directly contrary to his training, and to any specific direction from GMP, and rather, when accessing and disseminating the information, he was on a frolic of his own. GMP presented evidence that P had received appropriate training on accessing sensitive data and that each time P sought to access data on its systems, he was presented with a warning, advising that his actions would be audited, that he could only use the system for authorised purposes and that it was P's personal responsibility to ensure he complied with data protection legislation. GMP accepted that some of the data P shared had been lawfully accessed, but argued that in those instances it was the dissemination processing of the data that was unauthorised. The High Court agreed with GMP, applying the principles set out in the case of Ali and Luton Borough Council, those being that there must be a close connection between the wrongful conduct and the acts the employee was authorised to do. The close connection must be such that the wrongful conduct may fairly and properly be regarded as having been done in the course of employment. The mere fact that the wrongdoer's employment gave him the opportunity to commit the wrongful act would not in itself be enough to meet the close connection test. As the mere performance of acts, of the class which the wrongdoer was authorised or employed to do, may so clearly depart from the scope of his employment that his employer will not be liable for his wrongful acts, the wrongdoer must be acting in the course of his employment. If he is not engaged in that way, but rather is pursuing his own interests, or on a frolic of his own, no vicarious liability arises. Having consideration to the above, the court held that there was no relevant close connection between P's wrongdoings and his duties as a police constable that was sufficient to give rise to vicarious liability on the part of GMP. In particular, it found that the relevant acts were expressly forbidden by GMP. It found that the data accessed by P was sensitive, private and collected for very specific and limited police-related purposes. In accessing and disseminating the information, P had been pursuing his own interests which were wholly and obviously separate from the course of his employment. It noted that the only arguable connection was that P's employment allowed him the means to do the wrong, but the court did not consider such a connection to be close. It went on to say that while the actions which gave rise to the claim may, in a broad sense, be taken to fall within the class of actions which P was authorised to carry out on behalf of his employer, P went so far outside the scope of his employment that, on any sensible view, GMP could not be said to be responsible. It noted that the actions were criminal, contrary to policy, and would clearly be seen by an impartial observer as being separate from the functions of a police constable. It was no doubt helpful to GMP's defence that P had pleaded guilty to criminal wrongdoings, but nevertheless, having provided proper training and ensuring sufficient warnings, were given when anyone sought to access sensitive data were key factors noted by the court in determining that GMP were not liable for P's actions. and are steps other employers could take to help limit liability in similar situations. Look out for further episodes in this series to stay up to date on all things HR and employment law related.
