An employee of the Appellant, whose role gave him legitimate access to payroll data for the entire workforce, maliciously uploaded a file containing the data to a publicly accessible filesharing website. The Respondents, who were some of the affected employees, brought proceedings, against the Appellant personally and on the basis of vicarious liability, for breach of statutory duty under the Data Protection Act 1998 ("DPA 1998"), misuse of private information, and breach of confidence. In the High Court, the judge concluded that the Appellant was vicariously liable on each basis claimed, and rejected the Appellant's argument that vicarious liability was inapplicable given the content of the DPA 1998 and its foundation in an EU Directive. The judge also held that the employee had acted in the course of his employment, on the basis of Lord Toulson's judgment in Mohamud v Wm Morrison Supermarkets plc [2016] UKSC 11. The Appellant's subsequent appeal to the Court of Appeal was dismissed.

The issues on appeal to the Supreme Court were whether the Appellant was vicariously liable for its employee's conduct and, if so, whether the DPA 1998 excluded the imposition of vicarious liability for statutory torts committed by an employee data controller or for misuse of private information and breach of confidence.

The Supreme Court unanimously allowed the appeal. It concluded that the courts below had misunderstood the principles governing vicarious liability in a number of respects and held, applying the test laid down in Dubai Aluminium Co Ltd v Salaam [2003] 2 AC 366, that the employee's wrongful conduct was not so closely connected with acts which he was authorised to do that, for the purposes of the Appellant's liability to third parties, it could fairly and properly be regarded as done by him while acting in the ordinary course of his employment. Although it was not strictly necessary for it to do so, in view of the finding that the Appellant was not vicariously liable, the Supreme Court ruled that, since the DPA 1998 neither expressly nor impliedly indicates otherwise, the principle of vicarious liability applies to the breach of the obligations which it imposes, and to the breach of obligations arising at common law or in equity, committed by an employee who is a data controller in the course of his employment.