Employers' Liability and Vicarious Liability
A supermarket employee leaks 100,000 colleagues' payroll data out of a personal grudge. A milk roundsman, defying an explicit instruction, lets a boy ride along and the boy is hurt. A prisoner injures a co-worker in a prison kitchen. In each case, someone other than the wrongdoer is asked to pay. Understanding why the law sometimes says yes and sometimes says no to that question is the heart of employers' liability and vicarious liability — and it is tested relentlessly in SQE1 because every tort problem question involving a workplace, a hospital, a school, or a care home turns on it.
It is essential to keep two distinct legal routes apart, because SQE1 examiners deliberately blur them in scenario questions.
Primary liability is the employer's own fault — a personal, non-delegable duty owed directly to its employees. Vicarious liability is strict, secondary liability for someone else's tort — the employer did nothing wrong itself, but the law makes it answer for the wrongdoer's conduct because of the relationship between them.
Confusing these is the single most common error candidates make. An employer can breach its primary duty without any employee committing an actionable tort against a third party, and an employer can be vicariously liable for an employee's tort even though the employer's own conduct was impeccable. They are separate causes of action, pleaded and analysed separately, and a good answer signals which one is in play before diving into the detail.
An employer owes its employees a personal, common law duty in negligence to take reasonable care for their health, safety, and welfare at work. This is not borrowed from anyone else's fault — it belongs to the employer directly, which is why Wilsons & Clyde Coal Co v English [1938] AC 57 is the anchor case: it established that this duty is personal and non-delegable. That word "non-delegable" matters enormously. It means the employer cannot escape liability simply by handing the job of keeping people safe to someone else — a competent contractor, a supervisor, a specialist. If that fourth party does the job badly, the employer is still on the hook, because the duty was always the employer's own to discharge, not merely to arrange.
Traditionally, the courts have broken this single duty down into four practical strands, and it is worth holding these in mind as a checklist when working through a fact pattern:
| Element | What it requires |
|---|---|
| Competent staff | Reasonable care in selecting, training, and supervising employees so colleagues are not exposed to unreasonable risk |
| Adequate material and equipment | Supplying proper plant, tools, and machinery fit for the work required |
| Safe system of work | Reasonable organisation, sequencing, and supervision of tasks, including instruction, training, and warnings of known risks |
| Safe place of work | Reasonable care over the physical premises, including safe access and egress |
On equipment specifically, Parliament closed an unfair gap with the Employer's Liability (Defective Equipment) Act 1969: if an employee is injured by a defect in equipment the employer provided for its business, the employer can be treated as liable even if the defect was actually the fault of a third-party manufacturer. Without this, an employee injured by a manufacturing flaw in a tool might find the employer blameless and the manufacturer hard to sue or trace — the Act puts the risk of chasing the manufacturer onto the (better-resourced, insured) employer rather than the injured worker.
Because the duty is non-delegable, an employer remains liable in negligence even where it entrusts performance of some aspect of the duty to a competent contractor or employee — again, this is distinct from vicarious liability, which attaches to the separate tort of another person. Here, the employer is answering for its own failure to ensure the job was done safely, not standing in for someone else's wrongdoing.
The standard is that of the reasonable and prudent employer, judged by what the employer knew or ought to have known at the time — an ordinary negligence-style objective standard, but one that flexes with the employer's actual or constructive knowledge.
Two classic illustrations show this flexing in opposite directions. In Stokes v Guest, Keen and Nettlefold (Bolts and Nuts) Ltd [1968] 1 WLR 1776, the court held that an employer with greater than average knowledge of a risk may need to take more than average precautions — knowledge raises the bar. Conversely, an employer that follows a recognised and general industry practice without prior mishap is generally entitled to rely on it, unless that practice is clearly bad in light of common sense or newer knowledge — following the herd is a defence, but not an absolute one.
The magnitude of foreseeable harm to a particular employee is also a relevant factor. Paris v Stepney Borough Council [1951] AC 367 is the textbook example: the employer owed a heightened duty to a workman known to have sight in only one eye, because the seriousness of potential harm to him — total blindness versus the loss of one eye for a fully sighted colleague — was so much greater. The lesson generalises: known vulnerability increases what precautions a reasonable employer must take, even where the likelihood of an accident is identical for every worker.
The duty is not confined to physical injury. It extends to taking reasonable steps against reasonably foreseeable psychiatric injury caused by workplace stress. Walker v Northumberland County Council [1995] 1 All ER 737 held the local authority liable for a social worker's second nervous breakdown, because once the employer knew about the first breakdown, further psychiatric injury from his continuing excessive workload became reasonably foreseeable — foreseeability, once again, tracking what the employer actually knew.
Because this is a claim in negligence, the claimant still has to prove the full quartet: duty, breach, causation, and loss. Nothing about the employment relationship relieves the claimant of that burden. And any damages awarded can be reduced for contributory negligence under the Law Reform (Contributory Negligence) Act 1945 where the employee's own carelessness contributed to the injury — the employer's primary duty does not make the employee's own carelessness irrelevant.
Employers' primary liability does not sit in a common-law vacuum. The Health and Safety at Work etc. Act 1974 imposes a general statutory duty on every employer to ensure, so far as is reasonably practicable, the health, safety, and welfare at work of all employees. For decades, breach of the detailed regulations made under that Act (covering machinery guarding, manual handling, and so on) gave employees a strict civil right of action — proof of breach alone, without fault, could found a claim.
That changed with section 69 of the Enterprise and Regulatory Reform Act 2013, which removed the automatic civil right of action for breach of most health and safety regulations made under the 1974 Act. The practical consequence for SQE1 purposes: a claimant alleging breach of a health and safety regulation must now generally frame the claim in common law negligence and prove fault, rather than relying on a strict breach-of-statutory-duty claim. This was a deliberate policy shift — away from strict liability, back toward a fault-based standard — so do not assume that a regulatory breach automatically wins the case; it must still be shown that a reasonable employer would have avoided it.
Finally, none of this liability is worth much to an injured employee if the employer cannot pay. The Employers' Liability (Compulsory Insurance) Act 1969 requires an employer carrying on business in Great Britain to maintain approved insurance against liability for bodily injury or disease sustained by employees in the course of employment — the compulsory-insurance backstop that makes primary liability practically enforceable.
Turn now to the second, conceptually quite different doctrine. Vicarious liability is a form of strict, secondary liability under which an employer is held liable for a tort committed by an employee, without any need to prove fault on the employer's own part. The employer may have done everything right; it is liable anyway, because of the relationship and the connection between that relationship and the wrong.
Establishing vicarious liability requires satisfying a two-stage test:
- A relationship between the defendant and the tortfeasor capable of giving rise to vicarious liability.
- A sufficiently close connection between that relationship and the tort.
Stage One: The Relationship
Traditionally, stage one required a contract of service (employment) rather than a contract for services (independent contracting). The leading test comes from Ready Mixed Concrete (South East) Ltd v Minister of Pensions and National Insurance [1968] 2 QB 497: a contract of service requires the worker to provide work and skill personally for remuneration and to agree to be subject to a sufficient degree of control by the other party — and, crucially, the contract's other provisions, taken as a whole, must also be consistent with it being a contract of service rather than a contract for services. Control over how, when, and where work is done remains a key indicator distinguishing employee from independent contractor.
But the modern law has moved well beyond formal contracts. Vicarious liability can attach to relationships that are not contracts of employment at all but are akin to employment in substance. The pivotal case is Various Claimants v Catholic Child Welfare Society [2012] UKSC 56 (the "Christian Brothers" case), which held that lay brothers with no employment contract with their Institute were nonetheless in a relationship akin to employment for vicarious liability purposes. Lord Phillips identified five policy incidents typically present in such relationships, which have become the standard analytical checklist:
- The defendant is more likely than the tortfeasor to have the means to compensate the victim (and can be expected to insure against the liability).
- The tort was committed as a result of activity undertaken on the defendant's behalf.
- The tortfeasor's activity is likely to be part of the defendant's business activity.
- The defendant created the risk by employing the tortfeasor to carry out that activity.
- The tortfeasor was, to a greater or lesser degree, under the control of the defendant.
Cox v Ministry of Justice [2016] UKSC 10 confirmed the reach of this framework: the Ministry of Justice was held vicariously liable for a prisoner's negligence while working in a prison kitchen, even though the prisoner was plainly not an employee. The Court confirmed vicarious liability can arise where the tortfeasor's activity is integral to the defendant's business, carried out for the defendant's benefit, and the risk of the tort was created by the defendant assigning the activity to the tortfeasor.
But the akin-to-employment doctrine has limits, and the Supreme Court has since pulled back from its outer edge. A relationship is not akin to employment — and cannot found vicarious liability — where the alleged tortfeasor is in reality carrying on business on their own account as an independent contractor. Barclays Bank plc v Various Claimants [2020] UKSC 13 applied exactly this limit: Barclays was held not vicariously liable for a self-employed doctor's alleged sexual assaults during pre-employment medical examinations, because he ran an independent portfolio medical practice rather than standing in any relationship akin to employment with the bank. The lesson for exam scenarios: where a person is genuinely in business on their own account — their own clients, their own insurance, their own control over how the work is done — the five-incidents analysis will usually not even be needed, because the answer is already clear.
Stage Two: The Close Connection Test
Even with the right relationship established, the tort must have been committed in the course of employment — assessed today using the close connection test. This test replaced the older, narrower Salmond formulation (asking only whether an act was an authorised act done in an unauthorised way) after Lister v Hesley Hall Ltd [2001] UKHL 22, which held a care home employer vicariously liable for sexual abuse committed by a warden. The close connection test asks whether the wrongful act is so closely connected with acts the employee was authorised to do that it can fairly and justly be regarded as done by the employee while acting in the ordinary course of employment.
Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11 restated this as a two-part inquiry: first, what functions or field of activities were entrusted to the employee; second, whether there was a sufficient connection between the employee's role and the wrongful conduct. On the facts, Morrisons was held vicariously liable for a kiosk employee's unprovoked violent assault on a customer that began at the till (within his role) and continued onto the forecourt — the assault was treated as an unbroken, if brutal, continuation of the interaction his job required him to have with customers.
This confirms that an employer can be vicariously liable for an employee's intentional torts — assault, sexual abuse — just as much as for negligent ones, provided the close connection test is satisfied. But the test has a real limit: an employee who acts entirely for personal reasons unconnected with employment — traditionally described as being on a "frolic of their own" — will not usually trigger vicarious liability.
WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12 (a different Morrisons case from Mohamud, decided the same day as Barclays) is the clearest recent illustration of that limit. Morrisons was held not vicariously liable for a senior IT auditor's deliberate, unauthorised leak of colleagues' payroll data onto the internet, because he was pursuing a personal vendetta against the company following disciplinary action, not furthering his employer's business. The Supreme Court clarified that the earlier language in Mohamud suggesting a wrongdoer's "motive is irrelevant" was not a general statement of principle — motive matters precisely when it shows the tortfeasor was acting in a purely personal capacity. The case also confirmed something doctrinally important: vicarious liability can in principle apply to statutory torts, such as breach of data protection legislation, and is not excluded merely because a specific statutory liability regime also exists — it simply failed here on the close-connection facts, not because data breaches are categorically outside its scope.
Disobedience Is Not Always a Defence
A subtlety that examiners love to test: an employee's act performed in direct disobedience of an employer's express prohibition may still fall within the course of employment, if the prohibition merely restricts how an authorised task is carried out rather than defining the scope of the task itself. Compare two classic contrasting cases:
- Rose v Plenty [1976] 1 WLR 141: a milk roundsman, in breach of an express prohibition on taking helpers, let a boy help him on his round. The employer was held vicariously liable, because the act was still done for the employer's business — the prohibition regulated how the round was done, not whether he was doing his job.
- Twine v Bean's Express Ltd [1946] 1 All ER 202: a driver gave an unauthorised lift to a hitchhiker contrary to instructions. The employer was not vicariously liable, because giving the lift was not done for the employer's purposes at all — it fell outside the scope of the job entirely, rather than merely being a prohibited method of doing it.
The distinction is subtle but decisive: ask whether the prohibited conduct is a mode of performing the job (Rose v Plenty) or a frolic wholly outside it (Twine).
A point easily missed under exam pressure: an employer's vicarious liability is additional to, not a replacement for, the personal liability of the employee who committed the tort. A claimant may sue either or both. And as between employer and employee, Lister v Romford Ice and Cold Storage Co Ltd [1957] AC 555 held that an employer held vicariously liable can in principle recover a full indemnity from the employee, because the employee owes an implied contractual duty to perform work with reasonable care. In practice, however, this indemnity is rarely enforced — employers' liability insurers operate under a long-standing informal "gentlemen's agreement" not to pursue such claims against employees, so the Lister v Romford Ice right exists mostly in theory rather than in everyday practice. Flag this practical point if a scenario asks whether an employer can "get its money back" from the employee.
The relationship-akin-to-employment framework has been pushed by the courts into settings that look nothing like a traditional office or factory. Armes v Nottinghamshire County Council [2017] UKSC 60 held a local authority vicariously liable for abuse committed by foster parents against a child in their care — even though the authority had exercised reasonable care in selecting and supervising those foster parents. This is a striking result precisely because it shows vicarious liability's strict character: the authority's own conduct was faultless, yet it was still liable for someone else's wrong, because fostering was analysed through the same control-and-integration lens as employment.
Finally, keep a related but distinct doctrine in view: the non-delegable duty, separate from both ordinary employer primary liability and vicarious liability. This kind of non-delegable duty arises where a defendant assumes responsibility for the care of a vulnerable claimant who lacks control over how that care is delivered, and then delegates performance of that responsibility to a third party. Woodland v Essex County Council [2013] UKSC 66 recognised exactly this category: a school owed a non-delegable duty to a vulnerable pupil for the negligence of an independent contractor providing swimming lessons during school hours. Note how this cuts across the usual rule — ordinarily, an employer is not vicariously liable for the torts of an independent contractor, because a contractor is not in a relationship of employment or one akin to it. Woodland is the exception that proves that rule: it is not vicarious liability at all, but a free-standing non-delegable primary duty that happens to produce liability for a contractor's negligence, in the narrow category of cases where a vulnerable person has been placed entirely in the defendant's care.
When a problem question puts a workplace incident in front of you, work through it in this order: (1) identify whether you are dealing with the employer's own primary duty, someone else's tort via vicarious liability, or a non-delegable duty for a vulnerable claimant; (2) for primary liability, run through the four traditional elements against the reasonable-and-prudent-employer standard, checking for any heightened duty from known risk or known vulnerability; (3) for vicarious liability, work the two stages in order — relationship (contract of service, or akin to employment via the five incidents), then close connection (function entrusted versus wrongful conduct, watching for the mode-versus-frolic distinction); and (4) remember that these routes are independent, cumulative, and frequently both live on the same facts.