Package holiday operators may be liable for the criminal acts of hotel employees: X v Kuoni

United Kingdom

The Court of Justice of the European Union has handed down its much-awaited judgment in X v Kuoni Travel Ltd C-578/19 on the circumstances in which package holiday operators can be liable for the actions of employees of their suppliers. The court found that, where the employee’s actions are a service that the holiday operator has contracted to provide, the holiday company may be liable for the employee’s improper performance or non-performance of the contract. The case will now return to the UK Supreme Court to apply the CJEU’s ruling to the facts of this particular claim.


X went on a Kuoni package holiday to Sri Lanka in July 2010. During her trip, a hotel maintenance employee offered to show her a shortcut to the reception area; instead he took her to the engineering room, where he assaulted and raped her. X pursued a claim for damages against Kuoni for breach of contract and/or under the Package Travel, Package Holidays and Package Tour Regulations 1992, which implemented European Council Directive 90/314/EEC on package travel, package holidays and package tours in the UK. Kuoni contended that under article 5(2)(iii) of the Directive, liability did not attach if the improper performance of the holiday occurred as a result of an event which, even with due care, could not have been foreseen. 

X was unsuccessful at first instance and in the Court of Appeal. The matter reached the Supreme Court, who referred to the CJEU on two issues:

  • Did the actions of the hotel employee constitute improper performance of Kuoni’s obligations under the package holiday contract?

  • If so, was a defence under article 5(2)(iii) of the Directive available to Kuoni and how did the defence operate?

For the purposes of its decision, the CJEU was asked to assume that: (1) the employee directing X to the reception area was within the scope of the ‘holiday arrangements’; (2) directing X was a service that Kuoni had contracted to provide; and (3) the rape and assault constituted improper performance of the contract.

The CJEU decision

The CJEU considered that an employee of a hotel could not be considered a supplier of services within the meaning of article 5(2), on the basis that an employee performs work on behalf of a supplier of services and is not a separate supplier themselves.

Further, the court found that the Directive was intended to ensure a high level of consumer protection and that, where the duties arising from a package travel contract are performed by an employee of a supplier of the services, the performance or non-performance by the employee may represent a non-performance or improper performance by the supplier in relation to their obligations arising from the package travel contract, making the tour operator liable.

Article 5(2)(iii) of the Directive refers to an event that the “organiser or the supplier of services…could  not foresee or forestall”.

The CJEU found that the exemption could be relied upon where events “…cannot be foreseen, irrespective of whether they are usual, or from events which cannot be forestalled, irrespective of whether they are foreseeable or usual…”. The exemptions listed in article 5(2) contained specific instances where the supplier of services was not liable for improper or non-performance, but these were limited to circumstances where the failure did not fall within the supplier’s control. The hotel employee’s acts or omissions in this case fell within the tour operator’s control and therefore could not be considered unforeseeable.


This judgment will have a significant impact on defendant tour operators, as it limits the circumstances in which they can avoid liability for the acts of a hotel employee.

Post Brexit, the 1992 Package Travel Regulations (which enacted the Directive in the UK) continue to apply. The matter will now return to the Supreme Court, who will consider the case in light of the CJEU ruling.

If X had not booked a package holiday and had instead been assaulted at a self-booked hotel, the findings may have been very different, as the Directive would not have applied. Had English law applied to the contract with the hotel, liability for the actions of the hotel employee would have turned on whether the party contracting with the consumer was vicariously liable for the hotel employee. If the contract was directly with the hotel owner, the hotel owner could be liable for the actions of its employee.  Conversely, if the contract was with a third party, the position becomes more complicated – see our Law-Now on the Supreme Court decision in Barclays Bank plc v Various Claimants.