Off the Hook - UK Supreme Court Considers Companies' Vicarious Liability for Data Breaches by Employees

Since the introduction of the General Data Protection Regulation, data breaches and their consequences have been a huge topic in Europe and abroad, with the GDPR imposing tremendous fines for breaches if they occur. Needless to say, many companies have taken note of the courts dealing with these issues, and one case, in particular, has rattled many cases in its journey through the UK Courts; the Morrisons case. Disgruntled workers can cause huge damage to a company, its reputation and its customers, which can include the sharing of sensitive information, but the case has led to the question of whether a company can be vicariously liable for the breaches of their disgruntled workers, in particular in relation to data. To the delight of many, the Supreme Court has finally handed down its hotly anticipated decision in the Morrisons case at the beginning of April 2020.

The case of WM Morrison Supermarkets plc v Various Claimants concerned the grocery store chain Morrisons in the UK, and a former employee of the company, Andrew Skelton. During his tenure with the company, Mr Skelton was a senior in-house auditor, who had access to employee information for auditing purposes. After a disciplinary action against him, Mr Skelton copied information relating to around 98,000 employees from Morrisons internal systems and shared the data on a file-sharing website (subsequently also sending the data to three newspapers as an anonymous third party). Morrisons took action to remove the data from the website, and Morrisons was then sued by the Respondents (a collective of various employees) alleging vicarious liability for Mr Skelton's actions and the data breach. After several years of litigation via the High Court and Court of Appeal (with Morrisons losing at every stage), the matter finally landed on the desk of the Supreme Court for final determination.

Lord Reed, handing down the judgment of the unanimous court, initially considered the long appellate history of the matter and the findings of the lower courts. Lord Reed considered that the lower courts had misunderstood the principles governing vicarious liability, and saw that the matter would have to be considered entirely afresh by the Supreme Court.

The first matter was to consider the matter under the test set out in Dubai Aluminium, which required the court to consider whether "...the disclosure of the data was so closely connected with acts [Mr Skelton] was authorised to do that, for the purposes of the liability of his employer to third parties, his wrongful disclosure may fairly and properly be regarded as done by him while acting in the ordinary course of his employment". Indeed Mr Skelton was authorised to collate and transmit the data as a part of his function as an internal auditor. However, the question of whether the wrongful disclosure was so closely connected with that authorisation that it would render Morrisons liable for it.

Morrisons GC pictured before the judgment hearing

Following an exhaustive consideration of related case law, Lord Reed noted that mere employment giving Mr Skelton the opportunity to commit the act would not be sufficient to make Morrisons liable for the act. Even though, as set out by the lower courts, the acts were closely linked to what Mr Skelton was tasked to do (including their transmission), the acts were an independent personal venture of Mr Skelton's.

As set in Dubai Aluminium, for the employee's acts to cause vicarious liability through their acts, misguidedly or not, they would need to be done "...in furthering his employer's business". Clearly, he was not engaged in furthering his employer’s business when he committed the wrongdoing, as he was merely pursuing a personal vendetta against Morrisons, and the wrongdoing, therefore "...was not so closely connected with acts which he was authorised to do that, for the purposes of Morrisons’ liability to third parties, it can fairly and properly be regarded as done by him while acting in the ordinary course of his employment".

The Court then moved onto consider whether the Data Protection Act 1998 excludes vicarious liability for the torts caused by an employee.

As a starting point, DPA does not exclude vicarious liability either for a breach of the duties imposed by the DPA itself or for a breach of common law or equitable obligations. Although argued by Morrisons, the Court did not see that the DPA excluded employers vicarious liability impliedly (specifically under s. 13). In short, the Court concluded that "...the DPA neither expressly nor impliedly indicates otherwise, the principle of vicarious liability applies to the breach of the obligations which it imposes, and to the breach of obligations arising at common law or in equity, committed by an employee who is a data controller in the course of his employment".

The Court ultimately decided that Morrisons could not be held responsible for Mr Skelton's actions and allowed their appeal.

The case is a huge win for employers, particularly considering the appellate history and Morrisons' consecutive losses, and sets an important precedent even in the light of the GDPR which has taken over from the DPA. The position would most likely be the same under GDPR, so employers liability should not be excluded. Employers should therefore be extra careful to avoid any data breaches by employees during the course of their employment, and take any measures possible to avoid issues like that, especially considering the humongous fines that the ICO can impose under the GDPR.

Mind Your Language! - CJEU Decides on the Registration of Offensive Trademarks

Rude language can be a sore point of contention for many people. The offensive nature of trademarks has been litigated quite a bit in high-profile cases recently, including the case regarding the band "The Slants" (discussed more here) in the US. The European courts have faced the question of offensive trademarks sometime ago, and Advocate General Bobeck looked at this in some detail in the Summer of 2019. Following the AG's decision, the CJEU has finally considered the question of offensive trademarks and handed down their judgment earlier this year.

The case of Constantin Film Produktion GmbH v EUIPO concerned an application to register the name "Fack Ju Göhte" (EUTM 13971163), which is the name of a German comedy film produced by Constantin. The film saw tremendous success in the year it was published, and Constantin released a subsequent two sequels under the same name. The EUIPO refused the application under Article 7(1)(f) of the CTM Regulation, which prevents the registration of trademarks "...which are contrary to public policy or to accepted principles of morality". Constantin then appealed the decision, which ultimately ended up with the CJEU.

The Court began by limiting the scope of the issue, following the guidance of the Advocate General, to only consider whether the mark was contrary to accepted principles of morality, as the matter didn't relate to any issues of public policy.

To consider the above, the Court noted that, to determine the scope of Article 7(1)(f) "...it is not sufficient for the sign concerned to be regarded as being in bad taste. It must, at the time of the examination, be perceived by the relevant public as contrary to the fundamental moral values and standards of society as they exist at that time". This clearly shows that the morality the courts will be concerned with is transient, and the standard can fluctuate as morality does within wider society; however, the examiner will have to consider it within a snapshot in time when applied for.

Mittens just couldn't handle Rover learning any more bad words

Furthermore, the Court saw that this would be determined according to "...the perception of a reasonable person with average thresholds of sensitivity and tolerance, taking into account the context in which the mark may be encountered and, where appropriate, the particular circumstances of the part of the Union concerned". This includes "...elements such as legislation and administrative practices, public opinion and, where appropriate, the way in which the relevant public has reacted in the past to that sign or similar signs, as well as any other factor which may make it possible to assess the perception of that public".

Reviewing the judgment of the General Court, the CJEU determined that they had misapplied the law concerning Article 7. In their assessment, the General Court should have included, among the things they considered, the great success of the comedy, the fact that its title does not appear to have caused controversy, as well as the fact that access to it by young people had been authorised and that the Goethe Institute (which promotes the German language abroad) uses the movie for educational purposes. The General Court should not have merely considered the inherent vulgar nature of the English phrase it was compared to, namely "Fuck You", to decide that the mark would be contrary to public morality.

The Court also noted that one would have to take into account the freedom of expression, enshrined in Article 11 of the Charter of Fundamental Rights of the European Union when considering any infringement of Article 7(1)(f). The General Court considered that this would not be the case, which the CJEU clearly did not agree with.

Following the dismissal of the General Court's decision the CJEU then moved onto consider the trademark in question under Article 7(1)(f).

The CJEU thought that, following a discussion of the Board of Appeal's decision, the title of a film need not be descriptive of its content in order to constitute a relevant contextual factor in assessing whether the relevant audience perceives that title and an eponymous word sign as contrary to accepted principles of morality. Additionally, although the success of a film does not automatically prove the social acceptance of its title and of a word sign of the same name, it is at least an indication of such acceptance which must be assessed in the light of all the relevant factors in the case in order to establish the perception of that sign in the event of use of that sign as a trademark.

As said above, the movie spawned a further two sequels with the same name, all of which have had great success, and is used in educational purposes, it goes to show that it isn't against the public morality in Germany. The Court did note that, however, the perception of the phrase "Fuck You" will be different between German-speaking countries and English-speaking ones, especially when dealing with a phrase written phonetically and inclusive of other words, such as the name Goethe.

The CJEU determined that the EUIPO has failed to demonstrate to the requisite legal standard that Article 7(1)(f) precludes registration of the mark applied for under the above grounds.

The case is a very important one and highlights the potential evidence looked for when determining whether a mark is contrary to public morality or not. The case also demonstrates that freedom of expression is very relevant in this exercise, which this writer agrees with since the remit of trademarks should by no means be exempt from freedom of expression even though one could describe it as "commercial expression" rather than traditional expression as you would commonly think of it.

I Can Do What I Want - What Are The Limits to State Immunity in the US on Copyright Infringement?

Many national governments, and indeed US states, have particular immunities when it comes to their legal liability. In the UK, for example, the Crown has sovereign immunity from civil claims, which prevents the Crown from being sued by individuals or companies (to put things very simplistically). Similar legislation exists in the US, and there have been efforts to pass legislation to stop the immunity held by States. With this in mind, what is the extent of this immunity with regards to copyright? Can States simply infringe copyright without any regard to the copyright holders, or would they have to face some accountability? Luckily the Supreme Court recently took on this case and handed down its judgment late last month.

The case of Allen v Cooper concerned videos and photographs taken by Mr Allen for the company Intersal Inc., which discovered the shipwreck of the Queen Anne's Revenge (the famous ship owned by the pirate Blackbeard) in 1996 outside of the coast of North Carolina. The wreck, under both federal and state law, belongs to North Carolina. Mr Allen documented the recovery operation over the course of a decade and registered the copyright in those works. The State of North Carolina then published some of Mr Allen's videos and photographs in 2013 on its website, to which Mr Allen objected to. The parties agreed on a settlement of the initial dispute, however, Mr Allen then alleged further infringements by the State through the publication of five of his videos online and in a newsletter. Subsequently, he sued the State for copyright infringement, with the matter ending up with the Supreme Court.

Generally, a federal court generally may not hear a suit brought by any person against a non-consenting State, although this bar is not enshrined in the US Constitution. However, the courts have allowed suits to be brought if two conditions are fulfilled: (i) Congress must have enacted “unequivocal statutory language” abrogating the States’ immunity from the suit; and (ii) some constitutional provision must allow Congress to have thus encroached on the States’ sovereignty. In short, if there is legislation that repeals the States' immunity, which is permitted by the US Constitution, the suit can be brought against the State in question.

As set out by Justice Kagan (handing down the majority's decision), there is no question that the first requirement has been fulfilled. The Copyright Remedy Clarification Act of 1990 removed the States’ sovereign immunity in copyright infringement cases, and therefore it is possible, pursuant to Constitutional approval, that States could be sued for copyright infringement. The remaining question is whether Congress has the authority to pass the legislation.

After a very thorough discussion of the previous cases dealing with State immunity, the Supreme Court noted that Mr Allen will not be able to overcome the precedent set, where States cannot be sued for copyright infringement as matters stand.

The Court then moved onto discussing section 5 of the Fourteenth Amendment to the Constitution, which, can authorize Congress to strip the States of immunity. The abrogation has to be "appropriate" under section 5, which means that the abrogation must be "tailored to “remedy or prevent” conduct infringing the Fourteenth Amendment’s substantive prohibitions". Furthermore, the courts have held that the appropriate test for section 5 is that "...must be a congruence and proportionality between the injury to be prevented or remedied and the means adopted to that end" - to put differently, the courts have to consider both the nature and the extent of state conduct violating the Fourteenth Amendment.

Justice Kagan decided that the issue of copyright infringement didn't pass the above test. In the Court's view, the infringement of copyright by States is not a prevalent issue (consisting of only 12 cases), which left the balancing of the stripping of States immunity askew and not proportionate to the injury posed by State infringement. The Court did, however, leave the door open for Congress to pass laws in the future to abrogate States' immunity with regards to copyright infringement.

Ultimately, the Supreme Court dismissed Mr Allen's case and ruled that section 5 of the Fourteenth Amendment does not support the abrogation of States' immunity with regards to copyright infringement, and Mr Allen could not bring his infringement case against the State forward.

State or sovereign immunity cases don't come across very often, and it is always interesting to see the extent to which the courts will protect that immunity. The Court's approach to the proportionality of the possible injury with the stripping of the entire immunity seems sensible in this instance since governments should be given broader protections lest we see the dams break and a wave of cases being brought against States or governments. They shouldn't, by any means, be given carte blanche to do as they wish, but the stripping or specific immunities will need thorough and appropriate consideration in the future.