The recent decision of Lepan v TPG Telecom Limited [2026] NSWDC 328 highlights the importance of employers proactively managing known risks of customer aggression and violence, particularly where there is a heightened foreseeable risk at a particular workplace. The case provides useful more recent guidance on common law negligence claims.
Need to know
The plaintiff, a retail employee of the defendant’s telecommunication company, brought a negligence claim against his employer, after being seriously injured when a customer created a fireball directed at his face using an aerosol can and lighter. The defendant admitted it owed the plaintiff a duty of care but denied breach and causation. The District Court found the defendant breached its duty of care by failing to take reasonable precautions against the known risk of customer aggression at the store, including by failing to place a security guard at the store at a minimum during Friday trading hours. The Court also found that the absence of a security guard caused and materially contributed to the plaintiff’s injuries.
Background
The plaintiff commenced employment at the Wollongong Central Vodafone store in late 2015, before transferring to the Vodafone store at Macarthur Square in Campbelltown (Macarthur store) in November 2017.
On 22 November 2019, while working at the Macarthur store, the plaintiff interacted with a customer who became hostile and verbally abusive towards him after the plaintiff identified a fraud notation on the customer’s account and advised he could not provide further assistance. Several hours later the customer returned and confronted the plaintiff in a similarly hostile and abusive manner before producing a deodorant can and cigarette lighter. The deodorant can was sprayed and its contents ignited in the direction of the plaintiff’s head, creating a blowtorch and fireball directed towards his face (Incident). The plaintiff suffered superficial injuries to his arm and head as well as significant psychiatric injury and had not applied for or sought any employment since the Incident.
The issues for determination by the District Court were:
- whether the plaintiff’s injuries resulted from the defendant’s negligence; and
- the extent of the plaintiff’s entitlement to future economic loss arising from the injury.
History
The Incident occurred following a history of customer aggression, where over a three-year period, the plaintiff was regularly exposed to customer interactions involving verbal abuse, swearing, throwing objects including phones, spitting, hitting store computers or knocking over items as well as threats. The plaintiff described customer behaviour at the store as being ‘brutal’. The employer provided a staff portal for reporting such incidents, to which there was generally no response.
The Macarthur store recorded customer aggression at a much higher rate than the rest of the network, with 11 incidents in 2019 compared with a national average of 1.95 per store, about 5.5 times the national average. Approximately six months before the Incident, management advised that the Macarthur store was lodging too many adverse incident reports on the portal, and that staff needed to ‘slow down’ in making reports. The only other discussion with staff about these incidents was a pamphlet from head office, which the store manager laminated and posted on the back wall, telling staff to read it when they had time.
Of particular significance was an incident on 27 September 2019, less than two months before the Incident, when the plaintiff was abused by a customer, which included racist name-calling and allegations that staff were liars and frauds. In his incident report, the plaintiff told his employer:
“I no longer feel comfortable and safe at work with these types of customers threatening us. I’ve tried reasoning with them but there was no good outcome, and I feel the worst I’ve ever felt after the experience today.”
It was found that the incidents in 2019 reflected an escalation in customer behaviour progressing from verbal insults, threats to safety of staff to a physical assault on an employee. The defendant had previously responded to incidents of customer aggression by deploying security guards for short periods. However, its National Security Manager accepted that the deployment of security guards at the store was reactionary in that deployment only occurred in response to reported incidents and that no risk assessment had been undertaken before November 2019 of the risk of staff suffering injury from customer violence.
Findings
The Court stated that it is well established that an employer has a non-delegable duty to take reasonable care to avoid exposing employees to unnecessary risks of injury. This extends to taking reasonable care to protect employees from the criminal behaviour of third parties through the employer’s control of its employees and safe systems of work.
The Court found that the relevant risk was the risk of personal harm constituted by physical and/or psychological injury to staff arising from interactions with aggressive customers at the Macarthur store. The Court was ‘overwhelmingly satisfied’ that a reasonable employer in the defendant’s position would have foreseen that risk and found that the risk to staff of physical or psychological injury as a result of customer aggression ‘was not far-fetched or fanciful’. The Macarthur store was an outlier within the Vodafone network, customer aggression had escalated in the lead up to the Incident and the plaintiff had expressly informed the defendant that he no longer felt safe at work. The risk to the plaintiff was further heightened because aggressive customers were routinely referred to him by the assistant manager of the store. Fitzsimmons SC DCJ found “that the magnitude of the risk was significant” and that “there was a high degree of probability that an incident such as that involving the plaintiff on the day in question would occur”.
The Court was critical of the safety measures the defendant had in place, with the online training module provided to the plaintiff in December 2018, being ‘wholly inadequate’. Further, the defendant’s national security risk assessment conducted in 2019 had been undertaken in response to swarming attacks (where handsets/tablets on display in the stores were forcibly stolen by offenders) and did not assess the heightened risk of customer aggression at individual stores. No site-specific risk assessment had been undertaken at the Macarthur store prior to the Incident. The Court also criticised the other control measures deployed at the store as being fundamentally reactionary in nature and of limited use given the relevant risk exposure. Given the significant and escalating risk, the Court found that the defendant failed to take reasonable care by not providing a security guard at the Macarthur store, at a minimum during Friday store trading hours which was a relatively insignificant expense for a company of the defendant’s size and operational presence.
The Court accepted that a security guard would likely have prevented the customer from re-entering the store following his earlier aggressive behaviour or, alternatively, intervened when he again became hostile. Having reviewed the CCTV footage, the Court was satisfied there was sufficient time for a guard to intervene and remove the customer before he produced the aerosol can and lighter. Accordingly, the defendant’s failure to provide a security guard assigned to the store caused and/or materially contributed to the plaintiff’s injuries.
Damages
The plaintiff was awarded past economic loss as agreed, past loss of superannuation, future economic loss and future loss of superannuation. On the question of residual earning capacity, the Court found the plaintiff retained a capacity to perform low demand work such as shelf-filling, assessed at $250 net per week commencing 12 months after judgment, noting that his exercise of a power of attorney for his mother supported a finding of mental capacity to perform such work.
The plaintiff’s damages were limited to economic loss both past and future with no entitlement for damages for non-economic loss, by operation of section 151G of the Workers Compensation Act 1987 (NSW).
The plaintiff was awarded total damages of $1,028,063.54.
Key takeaways for employers
- Treat customer violence and aggression as a workplace risk: Repeated verbal abuse, threats, intimidation and other aggressive behaviour should not be regarded as simply part of working in a customer facing role. These behaviours can expose employees to both physical and psychological harm and require appropriate controls.
- Look for patterns and escalation: Incident reports, employee complaints and other workplace data can expose an increasing risk of customer aggression. Employers should consider whether particular workplaces, roles, shifts or periods of work present a heightened risk and respond before conduct escalates.
- Act on concerns about psychological safety: Where employees report feeling unsafe or distressed by customer interactions, employers should investigate those concerns and review whether existing controls remain adequate. Reporting systems should encourage, rather than discourage, employees to raise incidents and concerns.
- Undertake site-specific risk assessments: An organisation wide risk assessment may not capture risks at individual workplaces. Employers should undertake site-specific risk assessments and implement controls that respond to the particular risk profile of that workplace.
Please reach out to our Workplace & Safety team if you would like to know more.
