Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11

Citation

• Full case name: Mr A M Mohamud (in substitution for Mr A Mohamud (deceased)) (Appellant) v WM Morrison Supermarkets plc (Respondent)
• Neutral citation: [2016] UKSC 11
• Court: Supreme Court of the United Kingdom (on appeal from [2014] EWCA Civ 116)
• Judgment date: 2 March 2016
• Panel: Lord Neuberger, Lady Hale, Lord Dyson, Lord Reed, Lord Toulson
• Leading judgment: Lord Toulson

Facts

The claimant went into the kiosk of a petrol station operated by the defendant and asked a member of staff whether it would be possible to print some documents from a USB stick.

The employee responded with abuse. He ordered the claimant to leave, followed him out to the forecourt, and there subjected him to a serious and unprovoked violent assault. A supervisor tried to stop him; he ignored the instruction and continued.

The claimant sued the supermarket on the basis that it was vicariously liable for the assault. The claim failed at first instance and in the Court of Appeal.

Decision and ratio

The Supreme Court allowed the appeal and held the supermarket vicariously liable.

Lord Toulson identified two matters to be considered. The first is what functions or field of activities have been entrusted by the employer to the employee — put broadly, what was the nature of his job. The second is whether there is a sufficient connection between the position in which he was employed and his wrongful conduct to make it right for the employer to be held liable.

Applying that approach, the employee’s job included attending to customers and responding to their enquiries. What followed was an unbroken sequence of events beginning with that interaction. He had not metaphorically taken off his uniform when he followed the claimant onto the forecourt; he was purporting, however inexcusably, to act about his employer’s business in ordering the claimant to keep away from the premises.

Lord Dyson added that the close connection test had already been improved by explicitly incorporating the concept of justice, and that no satisfactory further refinement had been suggested.

Refined in 2020 — and a warning about the two Morrisons cases

Two different cases involving Morrisons are often confused. They are separate decisions on separate facts and they say different things.

This case, Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11, is the petrol station assault. The supermarket was held liable.

The other is WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12, decided on 1 April 2020. That concerned an employee who copied payroll data for thousands of colleagues and published it online while pursuing a personal grudge against his employer. The Supreme Court allowed Morrisons’ appeal: the circumstances in which the employee committed his wrongs were not such as to impose vicarious liability on his employer.

On the same day the Supreme Court decided Barclays Bank plc v Various Claimants [2020] UKSC 13, which concerned the first stage of the enquiry — whether the relationship between the defendant and the wrongdoer was one of employment, or sufficiently akin to employment, for vicarious liability to arise at all. The bank’s appeal was allowed: it was not vicariously liable for the acts of a doctor who carried out medical examinations for it.

Read together, the three cases give the modern structure: is the relationship capable of giving rise to vicarious liability, and if so, is the wrongdoing sufficiently closely connected with what the individual was engaged to do?

Why it matters for insurance

Almost every employer buys employers’ liability and public liability cover on the assumption that it answers claims brought by third parties injured by its staff. Mohamud shows how far that can reach: an unprovoked criminal assault by a junior employee, contrary to instruction, still landed on the employer.

The wording detail that matters most is how the policy treats deliberate acts. Many liability wordings exclude injury or damage expected or intended by the insured, and it is important to be clear that this refers to the insured entity rather than to a rogue employee. Where the exclusion is drawn more widely, an employer can be liable at law and uninsured in practice. That is a placement question.

Retail, hospitality, security, transport and licensed premises operators carry the highest exposure to this line of authority simply because their staff deal with the public face to face. Training records, incident logs and supervision arrangements are what underwriters look at, and they are also what defends the claim.

See also

• Lister v Hesley Hall — the House of Lords origin of the close connection test
• Various Claimants v WM Morrisons — the other Morrisons case, on the data leak
• Lloyd v Google — mass data claims and representative actions
• Spire Healthcare v RSA — aggregating many claims arising from one individual

References

• Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11 (Supreme Court, 2 March 2016)
• WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12
• Barclays Bank plc v Various Claimants [2020] UKSC 13

Frequently asked questions

What did Mohamud v Morrisons decide?

That the supermarket was vicariously liable for a violent assault committed by a petrol station kiosk attendant on a customer. Serving customers was within the employee's field of activities and there was an unbroken sequence of events connecting his job to the assault, so it was right to hold the employer liable.

Is this the same as the Morrisons data leak case?

No. They are two different cases. Mohamud [2016] UKSC 11 is the petrol station assault, in which Morrisons was held liable. WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12 is the payroll data leak, in which Morrisons' appeal was allowed because the employee was pursuing a personal vendetta rather than acting in the course of his employment.

Does liability insurance respond to an assault by an employee?

Usually yes, because the employer's liability arises through vicarious liability rather than through its own deliberate act. The point to check is how the policy words its deliberate acts exclusion, and whether it attaches to the insured entity or could be read to catch the acts of a rogue employee.

This page is insurance information for UK businesses, not legal advice. It summarises a reported judgment and explains why insurance buyers and brokers refer to it; it is not a substitute for reading the judgment or taking advice on your own facts. Case summaries are necessarily short and omit detail. Position stated as at August 2026.

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority (FRN 724952). This page is general information, not advice on a specific policy.