Is a company liable if an employee intentionally ignores company procedures? In the United States, how egregious does an employee’s actions need to be to override Respondent superior/Vicarious liability and hold the company blameless? A hypothetical example: Bob is a full-time employee of Acme Services, LLC. One of Bob’s responsibilities for Acme’s construction company clients is to verify that equipment rental invoices match delivery records before notifying the client to approve the invoices for payment. For all of the clients except one, Bob follows the procedures properly. For Client C, Bob does no verification and has the invoices paid as presented. Neither Bob nor Acme realize any benefit from this action. Acme conducts periodic audits of its client accounts (selected at random), and eventually the mishandling of Client C’s account is discovered. Bob is fired (his excuse for his actions is that he disagreed with the political views of the owner of Client C). A full audit of Client C’s account shows they have overpaid various vendors. If Client C sues Acme Services for damages, can Acme (or their liability insurance carrier) in turn sue Bob (with a reasonable chance of prevailing)? Can Client C sue Bob directly without also suing Acme? Could Bob or Acme (or both) face any criminal liability?
Acme is bound by Bob's actions so long as they were conducted with "apparent authority" from the perspective of Client C and involved his work duties, even if he carried them out contrary to company policy - unless Client C knew for a fact that Bob was violating company policy and didn't have authority within the company to do so when he was doing these things. Acme, directly, or Acme's insurance carrier, in a subrogation suit after it has settled the claim from Client C, could probably sue Bob, especially if he willfully violated company policy for the purpose of harming client C. This is rarely done, but ultimately Bob owes duties to Acme which he violated which probably give rise to liability, although proving that and collecting the judgment would both be difficult. If Bob had authority within the organization to deviate from company policy, however, which he would have a good cause to claim that he did, this would be a full defense to such a suit, since Bob was always acting as a disclosed agent of Acme. Client C probably cannot sue Bob directly, whether or not it sues Acme. In contract matters (which this would include) a disclosed agent is not responsible for the acts he carries out on behalf of his principal. For example, an employee who signs a promissory note on behalf of a company in an official capacity as a disclosed agent of the company isn't responsible for paying the note. This is different than the rule in tort cases where the principal and anyone whose actions personally caused the tort caused the problem is liable. For example, if the employee got into a car accident that was his fault while he was driving on the job for the company, both the company and the employee would be liable to the person who was hurt. The circumstances that you describe sound more like a breach of contract than they do like a tort, so Bob would probably not have any personal liability to Client C. Could Bob or Acme (or both) face any criminal liability? Unless Bob was the CEO or other senior officer of the company, Acme wouldn't face criminal liability, because he is too far down the chain of command to cause Acme the entity to have the requisite criminal intent. Realistically, failing to "verify that equipment rental invoices match delivery records before notifying the client to approve the invoices for payment" does not amount to a crime no matter who does it. This might be careless or a breach of contract, but it is not fraud or theft because it lack the necessary criminal intent. If Bob actively photoshopped equipment rental invoices with a specific intent to defraud Client C, he would probably be criminally liable for fraud, although even that isn't an open and shut case as it still basically involves failure to perform a contract according to its terms and a mere breach of contract is generally not a crime unless you intended not to perform it in the first place, when you entered into the contract.
Is there any type of California labor law that would allow for him to ask for compensation for lost wages? Your family member might have a claim of [intentional?] misrepresentation. Simply put, it is unjustifiable for a well-known transportation company to misrepresent for too long the requirements its drivers must satisfy. Assessment of other legal theories such as breach of contract or promissory estoppel requires a detailed knowledge of the interactions and terms between the parties. Freeman &amp; Mills, Inc. v. Belcher Oil Co., 11 Cal.4th 85, 107 (1995) points out that &quot;courts will generally enforce the breach of a contractual promise through contract law, except when the actions that constitute the breach violate a social policy that merits the imposition of tort remedies&quot;. Misleading and belatedly avoiding a hiree who relied on the company's conduct contravenes public policy because of the ensuing disruptions and uncertainty the company could and should have avoided. Accordingly, see Robinson Helicopter Co., Inc. .v Dana Corp., 22 Call Rptr. 352, 361 (2004) (&quot;[A] plaintiff advances the public interest in punishing intentional misrepresentations and in deterring such misrepresentations in the future.&quot;). Generally speaking, the doctrine known as economic loss rule bars claims of negligent misrepresentation involving no property damage or personal injury. That is in order to preempt a party from sidestepping contract law. However, the extent of the company's conduct as you describe it might forfeit the protections embodied in the doctrine of at-will employment.
If it is a multi-party contract, generally all parties to the contract have liability for its breach regardless of who is supposed to receive payment. It is possible to contractually negotiate for limitations of liability in a contract, but not all liability and only with clear language to that effect. Further, if the CorpA and Corp B and Corp C all anticipated at the outset that if there was liability that CorpB incurred that it would not be paid, that would constitute both common law fraud and a fraudulent transfer under the Uniform Fraudulent Transfer Act by everyone involved (entities and individuals) because one is anticipating incurring future liability in an entity with no anticipated capacity to pay it. The circumstances would also plausibly justify &quot;piercing the corporate veil.&quot;
As a general rule, if a business, like a bank, is legally required to keep information confidential, and an employee breeches confidentiality, then your recourse is to sue the business for damages. See for example ch. 35 of Title 12. The bank cannot claim "It's not our fault, an employee did it" (the Latin for this is "respondeat superior", whereby a part is also responsible for the acts of their agents). As far as I know, there is no law against asking for information that can't be given. This does assume, however, that your mother does not have a legal right to the information (which could arise from some form of co-signing). Also, would assume that they have a normal privacy policy, and not one where they say "We will tell your mother if she asks" (they would have informed you of that, so read the privacy policy). This is a question best answered by your own attorney, to whom you would reveal all of the details.
Insurance is regulated at the state rather than the federal level in the United States, and the terms of individual insurance contracts also matter. Most states prohibit insurance of intentional unlawful acts as a matter of public policy, either under common law doctrines or under express statutes or regulations. The public policy is that no one should be insulated from liability for their own intentional acts. And, in insurance policies for individuals who are not employers, this is typically accomplished with an intentional acts exclusion in the language of the policy. (Negligent acts are almost always insurable. The status of acts that constitute gross negligence, willful and wanton conduct, reckless conduct, or bad faith conduct, varies somewhat from state to state.) But, the situation is muddier when the insured is an employer or an entity. It frequently is possible for an employer or entity to insure itself against unauthorized misconduct by employees or officers or directors who are breaching their duties to the employer or company, rather than carrying out the official policies of the company. Factories don't knowingly do anything. People in or connected to factories do things and know things. And, if a factory employee is cutting corners in violation of his job responsibilities and that hurts the company, that could be an insurable risk. But, if a factory employee is acting in accordance with the directions of the CEO and Board of Directors in causing the factory to emit waste violating the law, and if the people giving him orders known that this violates the law, then this is probably not an insurable loss of the company as a matter of public policy. Another complication involves the question of who is insured. The Town of Greenfield may be able to legally buy insurance that compensates it for the costs of having to deal with intentional environmental law violations by factories undertaken as a matter of corporate policy in the town, even though the corporation couldn't buy this insurance. Indeed, the Town could even impose a tax on the corporation that requires it to pay the premium on the Town's insurance policy. But, this wouldn't relieve the corporation of liability or violate public policy because the insurance company would have a right of "subrogation" to sue to owner of the factory to reimburse it for the full amount of any claims that it had to pay to the Town. This is true even if the corporation and the responsible individuals in the corporation are, in fact, judgment proof or bankrupt, so that the subrogation right is actually meaningless in fact. It is also probably legal for a company to "self-insure", i.e. to set aside reserves of its own money to pay for it violations of the law in the future without regard to intent, and to have administrators employed to process payment in those situations, because then it is not actually insulated from harm for its own wrongdoing. But, this is risky because a policy of condoning illegal conduct could subject the company to punitive damages and sanctions in addition to compensatory damages. It also matters what kind of harm the insurance policy pays for. It would not be illegal, in almost any state, to issue an insurance policy that pays for a criminal defense lawyer for someone who is accused of a crime. But, it would be illegal in almost every state to issue an insurance policy that pays for fines and court costs and restitution imposed as punishment for committing a crime. Paying for a criminal defense lawyer, or a bail bond, at a time when you are presumed innocent, is not a form of punishment and hence is an insurable expense.
No, this is not an acknowledgement of guilt or liability. It offers a &quot;discount&quot; some sort of reduction in price. This could be an offer of settlement without admission of liability, or even just advertising for repeat business (unlikely as that may seem). Without the rest of the communication, there is no way to tell. Unless there are specific admissions, this statement alone is not likely to have much significance in such a case. Edit: There is still not enough context to tell exactly what the sender of this communication wanted to accomplish with the offer of the discount, but since the OP now says &quot;the party does not take the responsibility&quot; this is not an admission of guilt, whatever else it is. It sounds like some sort of backdoor form of settlement offer without admission, but that is far from clear to me. My original answer is not significantly hanged here.
Firstly: that depends on the jurisdiction. It might not even be possible at all for employers to attempt to sue their own employees for damages caused by negligence. Even terminating an employment contract for reasons of negligence is quite difficult in many jurisdictions. Second, if it is possible, the question is wether such legal proceedings could be expected to be successful. Employees making mistakes is part of the risk of doing business, and distinguishing a "mistake" from "negligence", "gross negligence" , or "intentional wrongdoing" by the employee ought to place quite a burden of proof on the employer. To be held negligent in the first place, the employer will have to to prove that the employee was aware of the fact that the password they used was common, well-known and extremely insecure. Knowledge of which passwords are common and well-known is, unless you are considered a skilled IT security professional, not something that a typical employee can reasonably be expected to know. Before there can be a case for negligence by the employee, the employer needs to make a strong case that: either the employee is that skilled IT security professional that really should have know better or the company can demonstrate that they provide all employees with adequate instruction and security training that includes how to select good passwords and which bad ones to avoid and that they seriously ensure both awareness of their password and security policies and compliance. even then, not enforcing a good password policy in your IT systems and assigning or allowing users to select weak passwords is in itself already negligent...
united-states The argument you are making, restated in legal terms, is roughly as follows: Users have a duty to not reuse passwords. When a user reuses a password, and their password is subsequently stolen and used to fraudulently access the plaintiff's system, that password reuse becomes the proximate cause of the plaintiff's business injury. Therefore, our storage of plaintext passwords cannot be the proximate cause, and so we cannot be liable. This argument is mostly wrong. Leaving aside the fact that you're going to have a tough time convincing a jury of #1, a tort may have more than one proximate cause. Both the password reuse and the plaintext storage were but-for causes of the injury (i.e. if either had not happened, then the injury would not have happened). The injury was foreseeable, because it is well known in the security industry that many users in fact do reuse their passwords, professional advice notwithstanding. In most US states, that's enough to establish proximate cause. In the minority of states using the &quot;direct causation&quot; test, you might be able to characterize the user's password reuse as an intervening cause, and thereby avoid liability. However, there are other elements of tort law which must be established aside from proximate cause, and so by itself this does not resolve the question of liability. Other defenses might be applicable; for example, the terms of service might contain an indemnification agreement, which (if upheld) would make the user(s) responsible. The defendant might also argue that there is no duty of care, that it was not breached, or that the injury was or should have been de minimis (i.e. that the plaintiff should have taken greater care to prevent damages arising from account hijacking).