Lepan v TPG Telecom Limited [2026] NSWDC 328
Key takeaways
In this matter an employer was found liable in negligence for a psychiatric injury suffered by an employee who was attacked by a customer, after the employer failed to station a security guard at a store with a history of customer aggression.
Despite the actions of the customer being a criminal act by a third party, the conduct was foreseeable and in such circumstances an employer is required to implement sufficient controls to minimise the risk of injury.
Brief facts
The subject incident
On 22 November 2019, the worker was working at the employer’s store when a customer asked the worker to assist with a ‘SIM swap’. The worker declined to assist after identifying a fraud alert notification for the account and the customer subsequently became hostile and verbally abusive.
The customer later returned to the store and continued to demand assistance in an aggressive manner. The worker moved behind the service counter to create a barrier and to access the duress button. The customer then produced a deodorant can and a lighter, sprayed the aerosol and ignited it, directing a fireball towards the worker’s head and face. The worker suffered superficial physical injuries together with a significant psychiatric injury.
The store's history of customer aggression
The evidence established that, between January 2019 and 22 November 2019, the subject store recorded seven incidents of customer aggression, reflecting an escalation from verbal insults and threats to physical contact with staff. Across the employer’s national network of 100 stores, the subject store had 5.5 times the national average of incidents of customer aggression.
Approximately six months before the incident, staff at the subject store were told by management to 'slow down' on reporting incidents because the store was lodging too many reports. Two months before the incident, the worker reported in writing that he no longer felt safe at work and that attempts to reason with aggressive customers had 'no good outcome'.
The only training the worker had received in managing aggressive customers was a single online training module. A security guard was otherwise deployed to the store on an ad hoc basis on four occasions in the preceding 12 months, but only in response to specific incidents.
Judgment
The matter was heard before Judge Fitzsimmons in the District Court of New South Wales, who found in favour of the worker.
Breach
Judge Fitzsimmons reiterated that an employer owes a non-delegable duty of care to its employees to take reasonable care to avoid exposing them to unnecessary risks of injury, extending to a duty to protect employees from the criminal conduct of third parties, however ‘random or unpredictable’ that conduct may be.
On the evidence, the risk of injury was foreseeable considering that the store was a statistical outlier for customer aggression, the trend was escalating in the lead up to the incident, and the employer was aware of this given its own direction to staff to reduce incident reporting.
In determining the reasonable response to that risk, Judge Fitzsimmons had regard to the magnitude of the risk, the probability of its occurrence and the minimal cost of deploying a static security guard at the store.
Judge Fitzsimmons also rejected the employer’s contention that staff had received adequate training, finding that the single online module was 'wholly inadequate'.
Causation
Judge Fitzsimmons accepted that a security guard would have prevented the injury either by deterring the customer from returning, by refusing him re-entry to the store, or by intervening before he produced the deodorant can and lighter. Accordingly, the employer’s failure to assign a security guard to the store caused or materially contributed to the worker’s injury.
Implications
Employers in industries that are customer facing should be aware of the risk of injury posed by the potential criminal conduct of third parties and implement appropriate controls to minimise the risk of injury. Even where an employer maintains a general, network wide work safety system, it cannot rely on that system where its own data identifies a particular workplace as a statistical outlier for a known risk.
This decision confirms that a reactive approach to security will not discharge an employer's duty where the data shows a clear, escalating pattern at a specific location. Additionally, training should incorporate competency based or scenario-based components, especially in circumstances where staff safety depends on the ability to de-escalate confrontations with members of the public.
