Employment Judge StreetMr Jovcic-Sas for claimantMr Williams (instructed by counsel) for respondentDate 22 June 2023
JUDGMENT
This is the reserved Judgment of the Tribunal. The Claimant’s claims of unfair dismissal, automatically unfair dismissal and detriment on the grounds of protected disclosure are dismissed. Written Reasons are provided. The Remedy hearing listed for 18 July 2023 is not required and that date has been removed from the list. It will not proceed.
REASONS
Remedy
[1]Background 1.1. These are the Reasons for the accompanying Judgment given following a reserved decision reached on 19 June in chambers. 1.2. This is a claim for unfair dismissal including automatically unfair dismissal and in respect of detriment on the ground of protected disclosures. 1.3. The claims are dismissed.[2]Evidence 2.1. The Claimant gave evidence on her own behalf from a written witness statement. 2.2. The Respondent called three witnesses, who gave evidence from written witness statements. They were Laurel Penrose, former Principal and Chief Executive of the College, who was in post at the relevant time; Melanie Smith, HR Advisor; Paul Fletton Director of Finance and MIS. The dismissing officer. Erica Draisey, Governor and member of the appeal panel provided a written witness statement but was unable to attend, given a delay in reaching her evidence. 2.3. The Respondent presented a bundle of documents, not wholly agreed, of 643 pages in the digital version and 669 in the physical version. It omitted documents and additional documents were supplied during the hearing, including one file of documents missing from the pleadings such as the ET1 and the amended response, and another (pages 670 – 720) of documents referred to in the evidence but omitted from the bundle and a policies bundle running to 121 pages. The Tribunal read those to which they were directed. Relevant court orders were still omitted but available from the Tribunal file. 2.4. Numbers in brackets in these reasons are references to the page numbers in the bundle, first the physical page number and then the digital page number.[3]Issues 3.1. The issues before the Tribunal to decide are agreed as set out in the Order of Employment Judge Midgley of 20 October 2022 (31/39), but taking into account that the Claimant withdrew reliance on a number of protected disclosures and taking into account the amendment that the Claimant was permitted to rely on at the hearing. 3.2. They are as follows, adhering to the original numbering for convenience of reference.[1]Time limits 1.1. Given the date the claim form was presented and the dates of early conciliation, any complaint about any act or omission which took place more than three months before that date (allowing for any extension under the early conciliation provisions) is potentially out of time, so that the Tribunal may not have jurisdiction. 1.2. The claim was made on 26 August 2021. 1.3. The ACAS dates were 15 June 2021 and 27 July 2021. 1.4. The Amendment application was made on 19 May 2023.[2]Unfair Dismissal 2.1. It is admitted that the Claimant was dismissed. 2.2. What was the reason for dismissal? Respondent asserts that it was a reason related to conduct, which is a potentially fair reason for dismissal under section 96(2) of the Employment Rights Act 1996. 2.3. Did the Respondent have a genuine belief in the claimant’s misconduct on reasonable grounds and following as reasonable an investigation as was warranted in circumstances? Was the decision to dismiss a fair sanction, that is, was it within the range of reasonable responses open to a reasonable employer when faced with these facts? The burden of proof is neutral here, but it helps to know the Claimant’s challenges to the fairness of the dismissal in advance and they are identified as follows: 2.3.1. the Claimant argues that the allegations did not individually or cumulatively amount to gross misconduct; 2.3.2. the Claimant argues that the third disciplinary allegation was trivial; 2.3.3. The Claimant argues that the Respondent failed to have any or any sufficient regard to the reasonable explanations that she gave in respect of two allegations, namely human errors made during the Claimant’s sickness absence (specifically in relation to the first disciplinary allegation detailed at paragraph 2(a) of the further and better particulars of claim). 2.4. Did the Respondent adopt a fair procedure? 2.5. If it did not use a fair procedure, what is the percentage chance that the Claimant would have been fairly dismissed in any event and, if so, when would that have occurred? 2.6. If the dismissal was unfair, did the Claimant contribute to the dismissal by culpable conduct? This requires the Respondent to prove on the balance of probabilities that the Claimant committed the misconduct alleged.[3]Protected disclosures 3.1. Did the Claimant make one or more qualifying disclosures as defined in section 43B of the Employment Rights Act 1996? The tribunal will decide: 3.1.1. What did the Claimant say or write? When? To whom? The Claimant says she made disclosures on these occasions3.1.1.124 September 2020, the Claimant emailed Jayne Davis raising concerns that the respondent’s website gave out of date information on the College website, wrongly identifying their data protection officer, and that there was a lack of privacy notice assurance by the Respondent when collecting new data from staff regarding their health risks in order to make a COVID risk assessment [43C ERA 1996]3.1.1.217 November 2020, the Claimant emailed Laurel Penrose on or about 17 November 2020 and raises concerns about the redaction method used by the Respondent being inadequate or unsafe and therefore was noncompliant with the GDPR requirements [43C ERA 1996]3.1.1.327 November 2020 the Claimant contacted the local authority, South Gloucestershire via a safeguarding referral form raising her concerns about the treatment of a vulnerable student but requested to remain anonymous [43G ERA 1996] 3.1.1.4, 3.1.1.5 withdrawn 3.1.1.6 10 February 2021, the Claimant wrote to the ICO to inform of the badly redacted document provided to her by the Respondent as well as expressing concern about whether they were capable of redacting personal data properly. She also expressed concern about the misinformation about UK GDPR included in a letter to her from the respondents lawyers [Shakespeare Martineau] [43F ERA 1996] 3.1.1.7 and 3.1.1.8 withdrawn 3.1.1.9 12 March 2021, in an e-mail to the ICO, the Claimant raised further concerns regarding the respondent’s failure to properly redact documents to prevent personal data being visible. This complaint was recently upheld by the ICO [43F ERA 1996] 3. 1.1 .10 15 March 2021, this complaint was repeated in an e-mail to the ICO and also highlighted that the Respondent’s website gave out of date information on the College website, wrongly identifying their data protection officer, and that there was a lack of privacy notice assurance by the Respondent when collecting new data from staff regarding their health risks in order to make a COVID risk assessments [43F ERA 1996] 3.1.1.11 and 3.1.1.12 withdrawn 3.1.1.13 28 March 2021, the Claimant contacted her local NHS Trust by e-mail. She raised that the Employee Health Assessment form used by the Respondents recruitment team and provided by the Royal United Hospital NHS Trust did not appear to be GDPR compliant. [43G ERA 1996] 3.1.1.14 28 March 2021, the Claimant emailed Paul Fletton at the Respondent who was acting as their data protection officer, and raised that the Employee Health Assessment Form used by the Respondent’s recruitment team and provided by the Royal United hospital NHS Trust did not appear to be GDPR compliant. [43C ERA 1996] By amendment dated 19 May 2023, On 27 March 2023, the Claimant wrote to the Respondent’s Anne Roberts expressing concerns about the potential risk to the health of students and staff during scheduled exams held on the 4th and 5th floors of the Macaulay Building in Bath during the first two weeks of November 2020. Asbestos had been discovered in these areas and the college’s governing body had been informed on 5th October 2020 that this part of the building “would be closed shortly” because of the known presence of asbestos – yet the Respondent did not inform any of its staff, students or their parents of the potential risk to them before these two floors were used.” [43C ERA 1996] 3.1.2. Were the disclosures “of information”? 3.1.3. Did the Claimant believe the disclosures of information were made in the public interest? 3.1.4. Was that belief reasonable? 3.1.5. Did the Claimant believe that the information tended to show that: 3.1.5.1. a criminal offence had been, was being or was likely to be committed; 3.1.5.2. a person had failed come out was failing or was likely to fail to comply with any legal obligation; 3.1.6. Was that belief reasonable? 3.2. If the Claimant made a qualifying disclosure, was it a protected disclosure because it was made to: 3.2.1. the Claimant's employer? (43C) 3.2.2. the Information Commissioners Office (“ICO”) in circumstances where the Claimant reasonably believed: 3.2.2.1. that the relevant failure fell within any description of the matters in respect of which the ICO is so prescribed and 3.2.2.2. that the information disclosed, and any allegation contained in it, are substantially true (43F) 3.2.3. to a County Council and an NHS Trust in circumstances where: 3.2.3.1. the Claimant reasonably believed that the information disclosed, and any allegation contained in it, were substantially true; 3.2.3.2. She did not make the disclosure for the purposes of personal gain; 3.2.3.3. She had previously made a disclosure of substantially the same information to her employer or to the ICO; 3.2.3.4. And in all the circumstances of the case, it was reasonable for her to make the disclosure, having regarding particular to: the identity of the person to whom the disclosure was made, The seriousness of the relevant failure, Whether the relevant failure was continuing or was likely to occur in the future whether the disclosure was made in breach of the duty of confidentiality owed by the employer to another person, The action the employer or the ICO had taken as a result of the previous disclosure, Whether the claimants disclosure to her employer complied with its policies and procedures[4]Dismissal (Employment Rights Act s. 103A)4.1 Was the making of any proven protected disclosure the principal reason for the Claimant’s dismissal?4.2 The Claimant had two years’ service and the questions which the Tribunal will have to address are:4.2.1 Has the Claimant produced sufficient evidence to raise the question whether the reason for the dismissal was the protected disclosures?4.2.2 Has the Respondent proved its reason for the dismissal, namely conduct?4.2.3 If not, does the Tribunal accept the reason put forward by the Claimant or does it decide that there was a different reason for the dismissal?[5]Detriment (Employment Rights Act 1996 section 47B)5.1 Did the Respondent do the following things:5.1.1 Initiating a disciplinary process5.1.2 Dismissing the claimant5.1.3 Rejecting the claimant’s appeal5.2 By doing so, did it subject the Claimant to detriment?5.3 If so, was it done on the ground that she had made the protected disclosures set out above? Remedy Unfair dismissal5.4 The Claimant does not wish to be reinstated and/or re-engaged5.5 What basic award is payable to the Claimant, if any?5.6 Would it be just and equitable to reduce the basic award because of any conduct of the Claimant before the dismissal? If so, to what extent?5.7 If there is a compensatory award, how much should it be? The Tribunal will decide:5.7.1 What financial losses has the dismissal caused the Claimant?5.7.2 Has the Claimant taken reasonable steps to replace their lost earnings, for example by looking for another job?5.7.3 If not, for what period of loss should the Claimant be compensated?5.7.4 Is there a chance that the Claimant would have been fairly dismissed anyway if a fair procedure had been followed, or for some other reason?5.7.5 If so, should the Claimant’s compensation be reduced? By how much?5.7.6 If the Claimant was unfairly dismissed, did she cause or contribute to dismissal by blameworthy conduct? If so, would it be just and equitable to reduce her compensatory award? By what proportion?5.7.7 Does the statutory cap of fifty-two weeks’ pay or £89,493 apply? Detriment (s. 47B)5.8 What financial losses has the detrimental treatment caused the Claimant?5.9 Has the Claimant taken reasonable steps to replace their lost earnings, for example by looking for another job?5.10 If not, for what period of loss should the Claimant be compensated?5.11 What injury to feelings has the detrimental treatment caused the Claimant and how much compensation should be awarded for that?5.12 Has the detrimental treatment caused the Claimant personal injury and how much compensation should be awarded for that?5.13 Is it just and equitable to award the Claimant other compensation?5.14 Did the ACAS Code of Practice on Disciplinary and Grievance Procedures apply? If so, did either party unreasonably fail to comply with it? If so, is it just and equitable to increase or decrease any award payable to the Claimant and, if so, by what proportion up to 25%?5.15 Did the Claimant cause or contribute to the detrimental treatment by their own actions and if so would it be just and equitable to reduce the claimant’s compensation? By what proportion?5.16 Was the protected disclosure made in good faith? If not, is it just and equitable to reduce the claimant’s compensation? By what proportion, up to 25%? 4. Findings of Fact What is set out below are the primary findings of fact made by the Tribunal. Discussion and analysis follow later, including findings on conflicts in the evidence unless minor. 4.1. Mrs Jovcic-Sas was employed by the Respondent from August 2016. At the material time, she worked term-time only, four days a week, as a learning support worker/facilitator. 4.2. She used her own computer at home for work but software had been installed by the College to enable her to access work emails. Policies 4.3. The Respondent has a disciplinary policy. Gross misconduct is defined as misconduct serious enough to destroy the employment contract between the College and the employee, which makes the further working relationship and trust impossible. Principle reasons for summary dismissal for gross misconduct include breaking safeguarding rules, unauthorised disclosure of information or misuse of trust of a serious nature and serious breach of confidentiality (policies bundle 76). The list is not limited to the instances given. 4.4. The Respondent has a Safeguarding Policy. That sets out key principles, practices and responsibilities. It emphasises that the welfare of all students is of paramount importance. “Everyone has a responsibility to act without delay to protect all students by reporting anything that might suggest there is abuse or neglect.” (policies bundle 82/84) (bold in original). 4.5. The first step where there are concerns about a learner's welfare but where there is no immediate risk of harm is to fill in a safeguarding referral form and submit it to the Safeguarding lead (89/90). September 2020 4.6. On 3 September 2020, an email was circulated to all College staff, asking everyone to complete a self-assessment of their individual risk, in relation to Covid 19, with the advice that it would only take a few minutes to fill out. It included free text boxes, so that full information could be given if the form did not invite it directly (75 /82). At least eighty staff identified themselves as vulnerable in responding to the e-mail. 4.7. Mrs Jovcic-Sas had some concerns about the form issued. She sent an email criticisng it as not complying GDPR principles. She pointed out that the form requested personal and confidential information and that she was unhappy that the guidance on its use and retention was inadequate. The privacy notice linked to “Microsoft’s own policy for using personal / confidential data and I don't want any of my potentially medical personal details to end up with the Microsoft Corporation”. 4.8. She said the survey did not accurately reflect the correct guidance from Public Health England. It did not invite information about factors that can affect personal risk including (for example) age, gender and ethnic background. (75 – 77 and 237/244). 4.9. This is the first of the protected disclosures relied on. 4.10. An in-person risk assessment was offered to her instead by Jayne Davis, Deputy Principal Curriculum and Quality, on 23 September (76/81). Ms Davis apologised for a delay in responding and set out that she would look at the issues raised in respect of GDPR and data ownership and would get back to her. But the risk assessment was needed, in respect of any vulnerability, “This is not to say that your observations about the form are incorrect, just that in these unprecedented times, getting the right mitigations in place for people at risk is of paramount importance.” 4.11. She offers a risk assessment that she will herself conduct with Mrs Jovcic-Sas, in which Mrs Jovcic-Sas, can describe her reasons for feeling vulnerable and they can discuss possible mitigations. She asks for a range of time slots that Mrs Jovcic-Sas can make within the next two days. 4.12. Mrs Jovcic-Sas accepted during the hearing that that response was positive (86/93). 4.13. On 1 October, Jayne Davis proposed that Sally Eaton undertake the risk assessment, it not yet having happened (243/250). Sally Eaton was a senior manager. 4.14. Sally tried to arrange a meeting. On 4 November, she emailed Mrs Jovcic-Sas, saying “Dear Anne Marie, I am confused. We could have met on Teams yesterday but you suggested meeting in person instead. Today we are on the same campus and can meet in person but you have asked to meet on Teams. I have sent you an invitation for 2.30 this afternoon…. Please make every effort to attend.” 4.15. Mrs Jovcic-Sas went off sick on 4 November at lunchtime, just before that meeting which had been specifically arranged for the risk assessment to be done, taking into account her availability. 4.16. Emily, her immediate line manager, then asked her to attend the meeting remotely so that the risk assessment could be carried out. 4.17. Mrs Jovcic-Sas refused to take part in a meeting by Teams, having left work reporting stress and anxiety. 4.18. Her email about her health, sent at 14.36 that day, explained that she had a growing feeling of being picked on by “Emily and Sally” in particular (91/98), and referring to feeling bullied by “Sally’s style of micromanagement”. She referred to “workplace managers who appear to be at the root cause of the high levels of stress and anxiety I am now experiencing.” 4.19. Sally apologised the same day and agreed it was a mistake to invite her to take part in a risk assessment, given that Mrs Jovcic-Sas had gone off sick. She pointed out, “It is not unreasonable for the College to complete a risk assessment, after you have disclosed to the College that you are vulnerable, and as such, does not constitute micro management or bullying. It is a matter of record that I have not seen you for several weeks... I am sorry that you consider a meeting to complete this risk assessment to be the cause of your feelings of stress and anxiety. There have been several emails where College has tried to engage you in the College’s risk assessment process in order to address the issues you have raised with regard to your health. This is a process that College has adopted with all of the staff who have declared a vulnerability and is solely designed to protect the workforce.” 4.20. Mrs Jovcic-Sas agreed during the hearing that it was a nice email. 4.21. Mrs Jovcic-Sas was off work on sick leave until 11 December 2020 when she returned to work. November 2020 4.22. Mrs Jovcic-Sas raised a subject access request (“SAR”) in October 2020. Documents were sent to her electronically with a covering letter dated 12 November 2020. 4.23. Mrs Jovcic-Sas wrote to Laurel Penrose, the Principal, on 17 November. She asked for an internal review of the response to her SAR that had been sent to her on 12 November (98/105). She proposed an informal meeting, at which she would ask her husband to accompany her. She invites Mrs Penrose to add a senior colleague, so long as it was not one of three named individuals, including the sender of the SAR documents, Barbara, and the two managers, Jayne and Sally. They had been contacting her over the outstanding risk assessment . 4.24. She raised data protection concerns in relation to the documents issued to her: “I can read all personal data “blacked out” which includes a parent’s name and personal email address. This appears to constitute a Data Protection breach which may be notifiable. The error made here is that Barbara has not redacted the personal data of third parties by using an appropriate software application.” 4.25. She explained to the Tribunal that she had printed off the documents and could read the material under the redactions by holding the printed pages up to the light. 4.26. She goes on to say more management errors being swept under the carpet but, “I fear reprisal from those whose actions (or inactions) deserve to be questioned.” “I feel isolated and intimidated by people at work who should be doing more to support me, especially now.” (99/106) 4.27. This is the second public interest disclosure on which Mrs Jovcic-Sas relies. 4.28. Mrs Penrose replied the following day, 18 November 2020 (98/106). She thanked Mrs Jovcic-Sas for reporting the potential data protection breach were appropriate. She urged her to contact HR (“Human Resources” in respect of any additional support she needed, if she felt unable to ask for help in her department. She asked for specific details of the breach including its extent and whether anyone else had seen the documents (100/107). She promised a fuller reply before the end of the week. 4.29. Mrs Jovcic-Sas agreed during the hearing that this was a correct response. 4.30. Mrs Penrose acted quickly because there is a requirement by the ICO for action within 72 hours of discovering a data breach. 4.31. Mrs Jovcic-Sas replied expressing a lack of confidence in HR but asking more about Occupational Health, a service mentioned in Barbara’s email. She explained the way that redaction in a pdf had failed because of the use of a marker pen instead of software. She makes suggestions as to how this can be avoided (100/108). 4.32. Mrs Penrose replied very fully on Friday 20th November 2020. In relation to the data protection breach, She thanks Mrs Jovcic-Sas for her concerns and for the additional information allowing her to investigate further. (114/122). 4.33. She goes on, “I believe the necessary processes concerning this incident have now been completed by the College in line with regulatory requirements. You have already confirmed that no other person has had access or seen the information provided but I request you now destroy all the data relating to your SAR request sent you on 12th November by Barbara Owen. The same documentation will be sent to you on Monday 23rd November 2020 in order that you have full access to the data. Please confirm that this has been undertaken. I note your comments about the software available for redaction purposes.” 4.34. Mrs Jovcic-Sas agrees that the request in that email for the data sent to her to be destroyed was clear (oral evidence). 4.35. Mrs Penrose also addresses the reference to management errors being swept under the carpet. She says she takes seriously the issues raised: the anxiety expressed, the suggestion that there will be reprisals for identifying the complaints more clearly, the claimant’s reference to being isolated and experiencing a lack of support and her reference to intimidation. Mrs Penrose asks for fuller information so that an investigation can be conducted, “Reprisals are not acceptable and against the ethos and values of the college. If you have evidence of this you need to advise us of it formally, in order that due diligence through process can be undertaken.” (108/115) 4.36. She declined a proposal for an informal discussion at this stage (109). 4.37. Ms Penrose took action to address the breach reported, including a review of redaction practices, stopping the use of a permanent marker, implementing instead Microsoft Word redaction tools, restricting redaction to trained staff members and reviewing College processes. 4.38. The Data Protection Officer was imminently leaving on health grounds, hence retaining control of the issue herself. Mrs Penrose acted in that role between 19 November and 31 December 2020. 4.39. It was put to Mrs Jovcic-Sas in the course of the hearing that Mrs Penrose had addressed all the other matters raised in her earlier e-mail and that the response to her comments were measured, sensitive and very appropriate. Her response was, “On this subject, yes”. Question “So nothing here you take offence to” Answer: “No” 4.1. Mrs Penrose asked Mrs Jovcic-Sas to consent to the e-mails marked “Private and Confidential” to be shared so that an investigation could be undertaken. Mrs Jovcic-Sas did not give that consent. She explained this during the hearing as follows, “People off sick are erratic. If a principal writes, I answer but I answered some, I did not answer the others. When you are off sick with stress and anxiety, you are not always remembering things, you are not always fully compos mentis, that is part of being off sick with stress and anxiety. “ 4.2. In her email of 24th November 2020, Mrs Jovcic-Sas opened her response with, “Thank you for your detailed response, Laurel. I will read it carefully over the next few days and reply to each of your points separately.” 4.3. Mrs Jovcic-Sas quoted in full in that email the paragraph above in which she is asked to delete the documents that had been sent to her with her SAR request. 4.4. She agreed in her oral evidence that she had read the request for the data in her hands to be destroyed. 4.5. She did not in her response of 24 November confirm that she had “destroyed all the data relating to her SAR request”. Instead, she asked for more information before considering the matter closed, and as to whether she should be alerting the ICO office, in case the College hadn’t. She said, “I think I deserve an explanation of exactly what “the necessary processes concerning this incident, have now been completed by the College in line with regulatory requirements” actually means, including if there were any lessons learnt and if any changes were made to any College processes relating to this incident.” 4.6. She asked about the training given regarding data protection and whether past incidents had been reviewed to prevent repetition. She said she was relying on information from the ICOs website and that “I hope you are doing the same and are complying”, giving the link (106/113). 4.7. In a further, detailed email on 26 November, Mrs Jovcic-Sas addressed the presentation of text to staff by avoiding justified paragraphs for ease of reading. She also raised the use of private information by the College and the limits on its circulation. That was because the template letter used stated that the College does “not transfer [your] information outside Europe”. That, she said, is a clear statement that her personal data might be transferred or processed anywhere in Europe including to or in countries that are not part of the EU or EEA. There are countries in Europe that are not subject to GDPR data protection law; for example, Albania, Serbia, Turkey, North Macedonia, perhaps even Russia. The statement that the College does not transfer information outside Europe was therefore not simply misleading, but potentially unlawful. 4.8. She raised other issues and commented that she did not think the covering letter for SAR disclosure was GDPR compliant and raised the possibility of alerting the Information Commissioner’s Office as a possible GDPR failing (111/118). 4.9. She complained that the invitation in the letter in response to her SAR request to ask for an internal review should not mean that she has to justify her request for a review in such length and detail. She said that, “Pushing back on my original email as you have, and not being willing to discuss it informally, appears to me as an attempt to discourage my attempts at whistleblowing. It fits a pattern of behaviour where the College appears to make more effort to sweep problems under the carpet rather than learn from them, in an open and respectful way. Nobody is perfect, but it helps if you can demonstrate a willingness to improve. Sadly lacking at Bath College in my experience.” 4.10. Mrs Jovcic-Sas did not provide the information that Ms Penrose had requested as necessary so that her concerns could be fully investigated. 4.11. Mrs Penrose wrote a detailed response on 27 November 2020, addressing the points raised, item by item, acknowledging points well-made and that pointed to the merits of improving the accuracy and readability of communications, pointing out the meaning of some of the wording, such as “copyright”. She agreed to a formal review and itemised the scope for it on the lines that Mrs Jovcic-Sas was requesting, asking for her confirmation. 4.12. She again asked that Mrs Jovcic-Sas authorise the use of previous correspondence currently marked Private and Confidential for the review. 4.13. Mrs Penrose required Mrs Jovcic-Sas to confirm that the data previously sent to her on 12 November had been destroyed, with confirmation by return. This was her third request. She prompted the use of a data breach report form, attaching the policy and form (115/123). 4.14. Mrs Penrose was writing while Mrs Jovcic-Sas was away from work, sick, with stress and anxiety. She explains that she had embarked on the detailed correspondence on the basis that since Mrs Jovcic-Sas was raising matters with her while off sick, it had some urgency. She was seeking to conduct a process that was clear and overt, one that Mrs Jovcic-Sas could feel was a robust and comprehensive undertaking. 4.15. On 27 November, another member of staff, Charlotte Long, sent a further copy of the documents sent as the response to the SAR on 12 November and asked Mrs Jovcic-Sas to destroy the documents she already had. (We have not seen those but by implication – including from the fact that Mrs Jovcic-Sas has not complained of a further data breach at this time – they were properly redacted.) Safeguarding referral November 2020 4.16. On 27th November 2020, Mrs Jovcic-Sas completed a safeguarding referral for South Gloucestershire council in respect of a diabetic student at Bath FE college, focusing on the use of a sensory room, isolating her for unrecorded periods of time (437/445). She had personally witnessed it on at least eight occasions and the first was in February 2020. Her report suggested that, “In my view, the College needs to have their safeguarding systems, procedures and working practises independently inspected and possibly improved.” She said that the College appeared not to be providing appropriate level of educational needs to the students.” (120/127) 4.17. This is the third public interest disclosure that Mrs Jovcic-Sas relies on. 4.18. She said in that referral that she had reported her concerns in October 2020 to someone at the College and was told it would be referred to the College’s safeguarding lead. She was not satisfied that had happened (117/126). (In May 2021, in her appeal against dismissal, Mrs Jovcic-Sas said she had raised that safeguarding concern with Barbara on 13 October and the same report is made in the document of October 2022, but we have not seen the report itself (517/524; 51/60). 4.19. Also on 27 November 2020, Mrs Jovcic-Sas responded to Laurel Penrose and Charlotte in relation to the destruction of the documents she had received, saying, “I will destroy the original faulty documents after: 1. I've sent them to the Information Commissioner’s office for them to assess what you should be doing about this particular data breach that I first alerted you to. 2. The College has provided me with the information I requested describing more detail about how you've dealt with the issue so far I have been seeking reassurance that you have dealt with this matter properly which you seem reluctant to provide. Therefore you leave me no choice other than to report this to the ICO, as a “whistleblower ”. Let's see what they say about it” (123/130) 4.20. On 30th November Mrs Penrose again wrote to Mrs Jovcic-Sas saying that she had on four previous occasions now being asked to destroy the original data sent on the 12th November 2020. Mrs Penrose goes on, “Having spoken to the ICO office, they have confirmed that the original data breach documentation has to be destroyed immediately and is not conditional on the actions outlined below in your e-mail. Under s170 of the Data Protection Act, it is a criminal offence to retain unauthorised data. The holding on to this data, by yourself would fall into this classification. This has been confirmed by the ICO office.” 4.21. She was reporting the advice she had been given. 4.22. She goes on to ask again that Mrs Jovcic-Sas confirm that the original data documentation set has been destroyed (122, 123/13O). The ICO had advised that the original data set did not need to be retained in order to deal with a breach (oral evidence). Mrs Penrose was following the advice given by the ICO, and it reflected her understanding in respect of the unauthorised retention of confidential data. 4.23. Mrs Penrose explained in her oral evidence that she had a sense of gathering urgency, “I felt we needed to maintain a pace in order that we could conclude this and therefore if there was a shorter time frame, there was less possibility of unauthorised data being circulated.” 4.24. That is why she telephoned the ICO rather than enter into correspondence. 4.25. Mrs Jovcic-Sas did not respond. She says now, “I probably did not respond because I probably wanted to figure out what this criminal offence was. Probably. I don't know.” Question “So instead of taking the request of your employer four or five times you want to figure out the criminal ramifications?” Answer “Possibly I wanted to understand the whole thing” 4.26. She accepted in oral evidence that the correspondence from Laurel Penrose was reasonable and appropriate. December 2020 4.27. On 4 December, Mrs Penrose consulted the ICO for a second time. She was advised that there were two courses of action open to her. The matter could be referred officially to the ICO or she could instruct solicitors to write a formal legal letter to repeat the instruction that the data be destroyed. That would give Mrs Jovcic-Sas a further opportunity to address the concern. 4.28. Mrs Penrose arranged for solicitors to be instructed through HR and on 4 December 2020 the firm of Shakespeare Martineau wrote to the claimant, “We are instructed by our client, Bath College, concerning your unauthorised and unlawful processing of personal data relating to third parties, which was provided to you inadvertently by our client in response to your data subject access request (DSAR). The law is quite clear you are retaining personal data without our client’s consent, conduct that amounts to a criminal offence under the Data Protection Act 2018 s170. Further, there are no reasonable grounds on which you could contend that you had our client’s consent to retain the personal data in question - the documents were redacted by our client with the intention of removing the potential for identification of third parties; our client has instructed you no fewer than five times to destroy the original documentation and to confirm that you have done so accordingly. This letter is intended as a final instruction to you to destroy the documentation immediately and to confirm by email to our client’s Lauren Penrose (at email address) that you have done so by 9.00 am on Monday 7 December 2020.” (143) 4.29. Mrs Jovcic-Sas did not delete or destroy the documents but at some point put them in a sub- folder in her inbox. 4.30. She agrees that she had also printed copies off, which is how she knew that the redaction was ineffective – she held the paper copy up to the light. She does not know what happened to the paper copy (oral evidence). 4.31. Mrs Jovcic-Sas did not reply to this letter. 4.32. On 14 December, Mrs Jovcic-Sas was advised by her own solicitor that she should delete the personal data and confirm that that was going to be done, unless she was going to raise a formal complaint or grievance about the breach (450/458). 4.33. Mrs Penrose waited until 11 December, allowing time for compliance, before reporting the issue to the ICO. The data breach report required by the ICO was sent on 18 December 2020. It was registered with the ICO as a reportable disclosure of retaining personal data without consent. 4.34. Mrs Penrose also wrote to Mrs Jovcic-Sas on 18 December, explaining steps taken in response to the concerns raised by Mrs Jovcic-Sas. The College had changed their approach to the redaction of documents, in accordance with Mrs Jovcic-Sas’ suggestions. Mrs Penrose explained the training given in relation to GDPR, according to the level of expertise required and the use of expert advice when necessary. 4.35. Mrs Penrose summarised and clarified the outstanding issues. She renewed her earlier requests for information, and the reasons for them. She said that she would consider the matter closed if she did not hear from Mrs Jovcic-Sas by 21 December 2020 (151/158). That was because she had been asking for information to enable matters to be taken forward, but no further information had been provided even in respect of serious allegations – that is, of potentially unlawful statements, fundamental errors, fear of reprisal and of being isolated and intimidated. 4.36. Mrs Penrose adds, “On the 20th November, 26th November, 27th November and 30th November 2020, I requested that you confirm that the original data documents had been destroyed. Additional requests (Charlotte Long email 27th November, letter via e-mail, Shakespeare Martineau 4th December), to destroy the original redacted materials have been sent. To date no confirmation of the documents being destroyed has been received (152/ 159). …. “Having spoken to the ICO, we have followed their guidance and have now formally registered this incident with them. Identifying the above issue as being the determinant of the non- reportable incident, (using their checklist) to becoming the reason for this now being classified as a reportable disclosure. Therefore, this issue is now with the ICO to take appropriate regulatory action in accordance with the Data Protection Act 2018 (ss-142 – 181), concerning the retaining of personal data without consent.” 4.37. Mrs Jovcic-Sas agrees that the emails from Mrs Penrose were civil. She agrees that this letter was written a month after her report of inadequate redaction and that she had not complied with the instruction to destroy the data sent to her (oral evidence). 4.38. Mrs Penrose reports that she was not upset or troubled by the report of the mistake in redaction. “We are always open and learn from mistakes, I was pleased to get her report. I would say the request to destroy the data set requiring 5 requests and one from lawyer and again on 18 December …and rather than destroying it having been sent another data set, not informing us that she had destroyed it aggravated the situation. And the original data breach was a non-reportable breach, by not responding it became a reportable data breach where we had to report it to the ICO so it aggravated the situation. The data set sent on 12 November had not been destroyed.” (oral evidence) 4.39. Mrs Penrose was not Mrs Jovcic-Sas’ line manager. She was involved with this correspondence and in particular the data breach. 4.40. She tells us that she was not concerned with or consulted over the decision to institute an investigation with the potential for a disciplinary procedure. We accept that, as explained below. 4.41. She denies that the investigation was started for any reason except the refusal to delete the unauthorised data: “The data breach - we welcomed any information concerning the data breach so we could act and improve, the problem was the 5 requests and the lawyer, and by 18 December, the request to destroy the data was not done and that led to the disciplinary. It was nothing to do the data breach, it was a reasonable request from myself. ….The ratcheting up of the concern was that Mrs Jovcic-Sas had access to unauthorised data. She was requested to destroy that data and had not done so. Because of that I had to go to the ICO and ask for the next step.” (oral evidence) 4.42. She was asked why she did not instruct someone in IT to go into Mrs Jovcic-Sas’ email account, to delete the data set, given that Mrs Jovcic-Sas was off sick with stress and anxiety. Her response was that, “The ICO recommend that the person who has the unauthorised data should confirm it has been destroyed and there was a strong possibility that there was a paper copy as well so it was to cover all bases.” 4.43. Mrs Jovcic-Sas returned to work on 11 December 2020 for that day only. She attended a Christmas gathering briefly that day. January 2021 4.44. Mrs Jovcic-Sas was due back at work in January 2021. She had been absent for 37 days. She does not work on Mondays, so her first day was Tuesday, 5 January (157/164) . She completed a return to work form, which included a “No” in relation to whether she was still experiencing symptoms and a “Yes” in a reply to a question as to whether adjustments were needed or issues to be addressed. The reference to adjustments/issues was not followed up. 4.45. On 6 January, Mrs Jovcic-Sas received a letter from Mrs Smith, HR, notifying her of an investigation into, “Incidents you are alleged to be involved in, namely, 1) An issue concerning GDPR 2) An instruction given to you by a manager.” (159) 4.46. There were to be two investigators, one assisting. Mrs Smith’s evidence is that the decision to commence an investigation under the Disciplinary procedure was one made by her in conjunction with her manager without reference to any line manager. That was not challenged by Mrs Jovcic-Sas’ representative who conducted his cross-examination on the basis that Mrs Smith and the HR Director, Clair Beaty-Pownall164 had made that decision. 4.47. Mrs Jovcic-Sas responded on 7 January to say that this was the last thing she had expected, having been on long-term sick due to stress and anxiety at work, and asking a series of questions. Those included about the training of the investigator, for copies of all communications about her personally, internal or with or to third parties, from 1 November 2020, for a copy of the informal fact-finding exercise that is expected before a decision is made to undertake an investigation, and for confirmation that Mrs Penrose was the individual initiating this disciplinary process (164/171). 4.48. She said, “It is my assumption that Laurel Penrose is behind this. If that is correct I feel obliged to inform you, confidentially, that I am considering a complaint against Laurel under the College’s dignity at work policy. To me, her actions to date have been intimidatory, unreasonable and overaggressive - particularly to someone with a fragile state of mind.” 4.49. On 8 January, Mrs Jovcic-Sas emailed Mrs Penrose, in response to the email of 18 December, which she had read on her first day back at work, 5 January. She said, “Personally, I have found your general approach over-aggressive and demanding, often emailing for reply when you knew that I was either off sick (due to work-related stress) or enjoying a Christmas break. …. I believe your entire approach has been disproportionate and unreasonable. The escalation into conflict and threats – as evidenced by the solicitor’s email just before Christmas and, this week, starting formal disciplinary action against me – are the latest manifestations of your intimidatory tactics. … There is evidence of bullying and harassment that I would like to you stop please.” 4.50. She goes on to say, “For the record, all documents that were first emailed to me … the ones containing a third party’s personal details, were deleted last year, following advice I received from the ICO” (230/237) 4.51. She had not said that earlier. 4.52. On 15 January, Mrs Jovcic-Sas again asserted in an email to Mrs Smith, and the two investigators, that “I’ve now spoken to ACAS and my solicitor and we all agree that, on the balance of probabilities, Laurel Penrose is the person behind your threatened action. 4.53. She was demanding to know who instigated the disciplinary investigation (this “vindictive disciplinary investigation”) (173). 4.54. On 26 January 2021, the ICO wrote back to the Data Protection Officer with regards to the personal data breach report made by Mrs Penrose on 11 December. No further action was required. It was recommended that the College consider further training with regard to redaction and also, “Taking proportionate action to ensure that the personal data disclosed to an unauthorised recipient has been fully recovered. If necessary, you may wish to engage legal assistance to ensure the return or permanent, secure deletion of any personal data sent in error. Continuing to hold or refusing to return personal data without the data controllers permission may constitute a criminal offence under section 170 of the Data Protection Act 2018. You should also consider obtaining written confirmation from the recipient, where possible, that they hold no copies of the data, nor will they share or disseminate this in any way”. (174/181) February 2021 4.55. On 3 February 2021, the principal social worker for safeguarding and quality assurance at Bath and North-East Somerset (“BANES”) wrote to Mrs Jovcic-Sas in relation to safeguarding report she had made and a report that a data breach had arisen in connection with that, whereby Mrs Jovcic-Sas’ first name and her partner’s had potentially been disclosed as whistleblowers to the parents of the service user (175/182). That email continued that, “in subsequent conversations no information regarding your identity was shared with the parents or the College.” 4.56. The question that arises from that is how her partner’s name, Peter, came to be associated by BANES with the safeguarding concern raised. He was not entitled to confidential information about College students. 4.57. Her explanation as to her husband’s involvement is that her husband Peter had made an initial inquiry to check that her name would not be mentioned if she made a whistle-blowing report. That does not explain how his name came to be linked to the report about a particular student or either name given to the College. She agrees that it would be a disciplinary matter if Peter had been given information about a student. Investigation Interview 4.58. On 8 February, Mrs Jovcic-Sas was interviewed remotely in the context of the investigation being carried out. At her request, the interview was recorded. The interview was confidential, because of the potential scope of the discussion (176/183). 4.59. The College had learned that the safeguarding referral had been recorded as made by Anne Marie and Peter. Peter was agreed to be Anne Marie’s husband. The College had concerns about confidential information having been shared with him, if he had joined in a safeguarding referral. 4.60. Mrs Jovcic-Sas confirmed that Peter was her husband. She was asked as to why the local authority would have recorded Peter as the person that made the referral about a College student. Her answer was simply, “I am not going to comment on that” and then suggested they ask Peter direct (192/199). She did not give the explanation she now gives that Peter had simply been asking whether she could remain anonymous in making this safeguarding report. 4.61. This safeguarding referral has been identified as the referral made by Mrs Jovcic-Sas in November to South Gloucestershire. 4.62. Mrs Jovcic-Sas denied that she had suffered any detriment at the hands of her employer as a result of making this report and showed surprise at the suggestion (oral evidence). 4.63. The interview began at 3.00. The transcript shows a break at 3.35 with the meeting to resume at 3.55. The recording apparently continued. Shortly before the interviewers rejoined, Mrs Jovcic-Sas is noted as saying, “Thanks. It’s now 52. I’m the only one in the meeting. What do I do?” Speaker 5 “What time did they say?” Mrs Jovcic-Sas “50” Speaker 5 “Pardon?” Mrs Jovcic-Sas 15.50. 53 now. Just don’t say anything.” At that point the investigating officers rejoin. 4.64. The interviewers had a concern, based on a male voice on the recording that Mrs Jovcic-Sas was not alone during this interview, which was conducted remotely. Mrs Jovcic-Sas said he had been passing through. 4.65. In the course of the interview, Mrs Jovcic-Sas confirmed her report of the 8th of January that she had deleted the documents, “I never saved it in the first place. So on that same day, I rang the ICO and I took their advice and deleted them. I never saved them in the first place. So it's deleted, it's done” (186/193) 4.66. She was asked when that was done, “I cannot confirm what date it was done. It was done back in November.” 4.67. That echoes her account on 8 January. 4.68. She did not say that she had not understood the request to delete the documents or data set or that she had forgotten that she had moved it to a sub folder on her inbox. 4.69. She confirmed that the ICO had told her to “just delete it” (205/212). ICO report February 2021 4.70. On the 10th of February 2021 Mrs Jovcic-Sas made a report to the Information Commissioner in respect of the failure to redact confidential information (209/216) that she had reported to the College on 17 November. This is the fourth protected disclosure on which she relies. 4.71. She wrote this, “I was surprised by the somewhat indignant tone of Laurel Penrose who kept challenging me for more information, refused to tell me how they were dealing with the potential breach and started demanding that I immediately delete the dodgy document and let her know that I had done so” 4.72. In her oral evidence she confirmed that she knew precisely what she had been asked to do and that is corroborated by this email: she was to delete the document with faulty redaction and confirm that it had been destroyed. 4.73. She goes on in the email of 10 February, “The “offending” badly redacted document Bath College emailed me was sent back to them a few days after I received it. I didn’t save the document to my computer, transfer it, print it or share it with anybody. I did not ask them to send me something they shouldn’t have and I began to resent being accused of breaching GDPR law myself by not destroying the document and informing the principal accordingly.” (209 / 216). 4.74. This is the only account in which Mrs Jovcic-Sas says that she returned the documents to Bath College. It is not what she said during the investigation interview (see para 1.98 above). 4.75. Mrs Jovcic-Sas told the tribunal that she did print the document, contrary to her account to the ICO (oral evidence). 4.76. She included in the email a complaint that she had been refused a copy of the management investigation guidelines, which she had been requesting for some six weeks (211/218). 4.77. That email was not copied to anyone at Bath College, according to the copies produced. 4.78. On or around 11 February, staff were sent an email with regard to social care worker vaccination pursuant to national guidelines (212/219). On 12 and 18 February, Mrs Jovcic-Sas made complaints about the vaccination of staff in particular the inappropriate criteria to prioritise others (including those younger and fitter than herself) for vaccination (285/292). 4.79. On 14 February, Mrs Jovcic-Sas made a complaint to the Chair of Corporation, Bath College, about the Head of Governance and Mrs Penrose. In outline, the Head of Governance had not been clear about how to raise a grievance against Mrs Penrose, and Mrs Penrose had failed in her duty to apply GDPR principles (216/222). Her complaint against Mrs Penrose related to the failure to conduct an internal review of the handling of the SAR request which Mrs Jovcic-Sas had requested in her email of 17 November 2020 – the email in which she had identified the redaction error. 4.80. On 17 February 2021, Investigator Kate Hobbs asked the Head of ICT & Learning Resources to check Mrs Jovcic-Sas’ outlook records. 4.81. He reported back the same day, “The following emails are in a subfolder in Anne Marie’s mailbox and have not been deleted. …the emails were cross-referenced and confirmed to be the original data sets.” (320/327) 4.82. Those emails are the documents she had been asked to delete. 4.83. In her oral evidence about her email to the ICO of 10 February, Mrs Jovcic-Sas said she did not save the document to her computer: “I have written, it says that I did not save the document to my computer. I did not. I did not save it to my system. That email, is the property of Bath College, and Bath College is the data controller, and therefore I cannot manipulate something that is not on my system and this is, as I said yesterday, a tool of work accessible for me doing my job and the ownership of Bath College. I did not save it to my computer, so it was not on my system, and what Bath College then does with their information is for Bath College to deal with.” (oral evidence) 4.84. It was put to her that that was a misleading answer. She had in fact transferred the data to a subfile on the inbox. Her answer remained, “The file exists on Bath College’s system, so I did not transfer it anywhere, I put it there where it belongs, on the Bath College’s system.” “I have explained several times that I put it in a subfolder on the college’s system and that I had forgotten about it.” 4.85. While acknowledging that the badly redacted documents were saved in her outlook account in a subfolder of the inbox, Mrs Jovcic-Sas repeatedly asserted in her oral evidence that she had not understood what she was being asked to do. There was no clarity in the instruction she had been given. She said, for example, “I was asked to destroy data, then I was asked to delete emails, I was asked about data sets, I was asked about destroying documents. Data sets are the college’s property. I understood the things I needed to destroy were on my computer and there was nothing on my computer. …. And if I was to destroy a data set, I would not know how to go about it.” “The instruction came in various forms which was really distracting because in the sequence of emails and investigation I have been instructed to destroy a data set, to delete data, to destroy documents, so the instruction in the sequence of events were misleading then obviously as I say, I have been also looking at the fact that it is the Respondent who is the data controller …… in the course of the whole issue I wasn’t quite sure what I was instructed to do and as time was passing by and because of my stress I parked it somewhere in the inbox and then I forgot about it.” 4.86. These are not problems that she raised at the time. On the contrary, her emails confirm that she understood the instruction given. She had not reported that she had stored the documents in a subfolder of her inbox, and had twice said she had destroyed them. March 2021 4.87. The investigation report was finalised on 5 March (297/305). In its conclusion it sets out that, “There is evidence that AMJS (“Anne-Marie Jovcic-Sas”) has falsely informed the College the data set (emails one and two) had been deleted, both verbally in her interview on the 8th February 2021 and in writing to Laurel Penrose on 8 January 2021. There is evidence that despite numerous formal requests to delete the data set, this still had not been actioned on 17 February 2121. There is evidence that AMJS did not make a formal safeguarding referral for AD, in line with College procedure, and therefore failed to comply with College safeguarding policy and practise. There is evidence that P (“Peter”) was named on the safeguarding referral and the balance of probability concludes AMJS was likely to have shared information with P therefore breaching confidentiality. Alleged further data breach by AMJS who confirmed she was alone at the start of the investigation meeting on 8 February 2021, but can be heard on the recording of the meeting telling someone to sit down and be quiet” 4.88. Formal disciplinary action was recommended, socially distanced and face to face, to avoid privacy issues. 4.89. It was also recommended that, “As the data set has not been deleted, the matter requires immediate referral to the Data Protection Officer for urgent liaison with the ICO.” (302/309) 4.90. On 9 March, Mrs Jovcic-Sas through her representative pursued her complaint in respect of vaccination requesting copies of the JCVI (“Joint Committee on Vaccination and Immunisation”) guidance and the “full text of emails sent (or received) from Bath College with regard to this matter” and correcting the spelling of “saliva”, “Mis-spelling “saliva” is unprofessional and, quite frankly, does not give the right impression of an organisation in terms of serious public health credibility.” (274/281) 4.91. By a letter dated 11 March from Melanie Smith, Mrs Jovcic-Sas was invited to attend a disciplinary hearing on Tuesday 23 March. That was issued in hard copy with the related documents. It set out the charges “ i) Failure to adhere to a reasonable instruction given to you by a manager. The investigation concluded that you falsely informed the College on two separate occasions (08/01/2021 and 08/02/2021) that the information sent to you by Barbara Owen had been deleted. This instruction was made by both the ICO and the Principal and Chief Executive. The College has evidence that this data had not been deleted as of 17/02/2021. ii) Breach of confidentiality and/or GDPR as you identified your husband ‘P’ (who is not an employee or a defined external partner of the College) in a Safeguarding referral you made to BANES which means, on the balance of probabilities, you discussed the learner’s personal information with ‘P’. In addition, you failed to follow the College safeguarding policy and practise with regards to this matter. iii) Further breach of confidentiality and/or GDPR on 08/02/2021. You confirmed that you were alone at the start of the investigation meeting on 08/02/2021 …..but you can clearly be heard on the recording of the meeting telling someone in the room to sit down and be quiet.” 4.92. The email sets out who the hearing panel will be, with Paul Fletton as panel chair, when and where the hearing will take place, that it concerns a disciplinary matter and potentially gross misconduct, the range of possible outcomes, that she will have the opportunity to put forward everything that she wishes to raise, that she has the right to be accompanied and the steps she can take regarding documentation. She was told how to request reasonable adjustments (272/279). 4.93. By a letter dated 11 March from the Deputy Principle, Jayne Davis, Mrs Jovcic-Sas was suspended. 4.94. The letter explains that, “This decision has been made following the conclusion of the disciplinary investigation and pending the disciplinary hearing due to the seriousness of the allegations made against you which potentially constitute gross misconduct which could result in dismissal, should the allegations be upheld. Given the seriousness and nature of the allegations, pending the hearing, the College believes it is appropriate that you are suspended without access to e-mail or the computer network.” 4.95. On 12 March in an e-mail to the ICO, Mrs Jovcic-Sas raised further concerns regarding the respondent’s failure to properly redact documents to prevent personal data being visible (210/217, 259/266) 4.96. This is the fifth protected disclosure on which she relies (issues 3.1.1.9). 4.97. She attached a number of documents which had been provided by the College following a recent subject access request (210/217). Her main point was that personal data that had apparently been redacted had not been. That is because of a technical point: if the text from redacted PDF's is copied and pasted into a new Word processing app, all the data is revealed including the personal data earlier redacted (97). 4.98. She produces an original redacted account dated 16 November 2020, which had been copied and pasted on 5 March 2021, in the process losing the redaction: the resulting version disclosed all the names discussed in relation to a breakdown in trust and communication amongst other staff members (97). 4.99. The College was not copied in to that report to the ICO. Mrs Penrose tells us that she was unaware of it until she saw the Tribunal file. No report to the College of the breach has been given or produced. 4.100. Mrs Jovcic-Sas had asked from the outset for a copy of the Management Investigation Guidelines. Ms Smith had refused those in February. Mrs Jovcic-Sas asked the ICO to assist her in obtaining a copy of it, saying she had done everything reasonable to try to persuade the College to share it with her (211/218). 4.101. On 13 March, a package was delivered from the College to Mrs JovcicSas at her home address. She assumed it contained the suspension letter and disciplinary policy. She did not open it until 18 March 2021. It included the invitation of 11 March to attend a disciplinary hearing on 23 March. She felt it unfair to have such short notice, she doubted that her representative would be able to attend, she needed time to prepare for “the most important meeting of my career” and said that “you need to delay this meeting”. The Respondent agreed to a postponement, the hearing now to take place on Tuesday 30th March 2021. 4.102. On 15 March 2021, Mrs Jovcic-Sas made a further complaint to the ICO. This is relied on as her sixth protected disclosure (issue 3.1.1.10). 4.103. Her earlier complaint of 12 March was repeated and she also pointed out that the College website gave out of date information, wrongly identifying their data protection officer, and that it did not include a proper privacy statement about how personal data, including medical data would be processed. Such data had been requested in respect of the Covid-19 risk assessments. (The text of this comes from her witness statement (paras132 – 158) but this email is not amongst those grouped under the heading Email to ICO February and March 2020 (meaning 2021). She gives no reference. We conclude it is not in the bundle). 4.104. She says of this that she suffered detriment, in that, “The Respondent did not acknowledge or correct the errors I flagged. Their displeasure manifested itself in a covert campaign to isolate and bully me with false and/or misleading accusations, ultimately resulting in my dismissal.” (witness statement para 158). 4.105. On 27 March 2021, Mrs Jovcic-Sas wrote to the respondent’s Head of Governance. She said she was raising “another serious whistle blowing issue that probably ticks a few boxes when it comes to the Public Interest Disclosure Act”. Her concerns were the potential risk to the health of students and staff during scheduled exams held on the 4th and 5th floors of the Macaulay Building in Bath during the first two weeks of November 2020. She raised the lack of Covid protections, power failures affecting the lighting and the clock and concerns about asbestos. Asbestos had been discovered in these areas and the college’s governing body had been informed on 5th October 2020 that this part of the building “would be closed shortly” because of the known presence of asbestos – yet the Respondent “did not inform any of its staff, students or their parents of the potential risk to them before these two floors were used.” (344/351). 4.106. This is a further protected disclosure relied on by the Claimant, introduced by an amendment for which she applied on 19 May and which she was given permission to rely on at the start of the hearing on 30 March; time limits were, as with all protected disclosures claims relied on, to be dealt with when the merits of the claims made were considered. 4.107. The email was initially sent to the wrong address. Mrs Jovcic-Sas sent it to the right address on the 2nd of April 2021. It was received after her dismissal (344/351). 4.108. On 28 March 2021, Mrs Jovcic-Sas emailed her local NHS Trust. She relies on this as a further protected disclosure (issues, 3.1.1.13). The issue was with a form used by Bath College and the RUH or perhaps supplied by the RUH to the College, either for use by the recruitment team or as an occupational health referral. The information given appears to be an incorrect reference to the Data Protection Act 2012 although the original is not included. 4.109. The same complaint was made to her employer on the same date and is relied on as a further protected disclosure (issues, 3.1.1.14). Mrs JovcicSas says that this was sent to Paul Fletton. No copy of the email is provided for the Tribunal. It was not mentioned during the disciplinary hearing. Mr Fletton was not asked about it in the course of the Tribunal hearing. 4.110. Mr Fletton had been appointed to chair the disciplinary panel. Mrs Jovcic-Sas had concerns about his independence, which she mentions in her witness statement (256). She explains there that it added to an anxiety attack that meant she could not attend the disciplinary hearing. She does not say in terms what her concerns were, but he was the data controller and many of her comments relate to data management, including the two reports relied on as protected disclosures on 28 March 2021. Disciplinary Hearing 4.111. The Disciplinary hearing took place on 30 March. Mrs Jovcic-Sas did not attend. She emailed. She gave two reasons for her non-attendance (670, 1 sb). She said she had not had sufficient time to prepare a response to the allegations and her union representative had annual leave commitments. She also said that the “whole affair was making her ill because of the increased stress and anxiety caused by yet more intimidation at work, dreaded having to attend for fear of an anxiety attack and having had a terrible night’s sleep, for the sake of her own mental health, was having a complete 24 hour break from work. She would see her GP and was effectively off sick. 4.112. She did not ask for a postponement. 4.113. Mrs Jovcic-Sas did not raise a concern here about the independence of Mr Fletton or his ability to be unbiased in his assessment. 4.114. She informed HR on the following morning that she was off sick due to the stress. 4.115. The hearing proceeded in her absence. There were two panel members. Mr Fletton was chairing it. He was told about the email from the Claimant. Her union representative was contacted. Mr Fletton understood that he had been notified of the hearing date and was available to attend. He had no instructions to represent Mrs Jovcic-Sas in her absence. He did not attend. 4.116. Mrs Jovcic-Sas was dismissed by letter issued by email on 1 April. (359/366). 4.117. The reasons given for dismissal were: that she had failed to adhere to a reasonable instruction given by a manager. She had falsely informed the College on two separate occasions (8 January 2021 and 8 February 2021) that the information sent to her had been deleted. The instruction had been given by both the ICO and the Principal and Chief Executive of the college. The evidence was that the data had not been deleted as of the 17 February 2021. Breach of confidentiality and /or GDPR in that she identified her husband “P” (neither an employee or external partner of the College) in a safeguarding referral and that means she probably discussed confidential information with her husband Peter. In addition she failed to follow the College safeguarding policy and practice. A further breach of confidentiality and/or GDPR on 8 February 2021 when in spite of confirming that she was alone at the start of the investigation meeting she can be heard on the recording telling someone in the room not to say anything. 4.118. Reasons are then given. 4.119. In relation to the poorly redacted documents, she had failed to obey the management instruction to delete them, disregarded an instruction to delete them and then lied about what she had done. 4.120. Witness evidence showed that she and her husband had jointly made a safeguarding referral to B&NES in respect of a student. “It is inconceivable that this would have been done without you having shared confidential details of the student with Peter Sas, and your view of the reasons why you felt this referral was necessary. During the investigation meeting you did not provide any reason why you included Peter Sas on the referral and offered no mitigating circumstances. You also showed no appreciation as to why this would constitute an extremely serious breach of confidentiality” (359/367). 4.121. The College policy required as a first action that the College safeguarding team is contacted and a referral form submitted. She had not done that: “You did not carry out this critical first step, which could have exposed the student to risk. This is despite being up to date with the required training and working in an area where our most vulnerable students are.” 4.122. As to the allegation of an undeclared person in the investigation meeting, whose presence was not authorised, that allegation was upheld. The panel had reviewed the documentary evidence and viewed part of the recording of the investigation meeting. “When a voice was heard early in the meeting you were challenged and initially denied that anyone was present. However, you quickly reconsidered that and said it was Peter Sas “passing through”…. Significant doubt is cast on your claim that Peter says was just “passing through” when, returning to the adjourned meeting earlier, you can be heard speaking to someone out of camera shot asking them a) what you should do and b) not to say anything. The nature of the conversation made it clear to me that there was a continued presence of an undeclared third party in the meeting…. Given the nature of the meeting and knowing that it would touch on sensitive safeguarding matters, such a breach of confidentiality is of serious concern.” 4.123. The finding was of gross misconduct on the basis of all three allegations. “The College has to be able to trust its staff to comply with its policies to safeguard its students and treat the information it holds in respect of them confidentially. Its policy seek to ensure legal and regulatory compliance and protect vulnerable individuals from having their confidential details being discussed with people external to the organisation, unless there is a formal arrangement in place.” 4.124. The panel found a continued willingness to wilfully mislead the college; that highly confidential information had been shared wrongfully; that there was no recognition of wrongdoing and no mitigation offered. Instead a confrontational stance had been taken. There was no evidence to suggest that if a sanction short of dismissal was imposed that she would not breach confidentiality/GDPR again in future. April 2021 4.1. On 14 April 2022, in an email to Mrs Jovcic-Sas, the ICO accepted that it was incorrect to advise that it was a criminal offence to retain confidential data that is received accidentally. It may be, but it is not for the ICO to determine whether the retention of personal data without the consent of a data controller is a criminal offence or not. Their role was to advise individuals of the relevant section of the Data Protect Act 2018 and make them aware that retention of documents could constitute a criminal offence. (671 – 674 sb) The appeal 4.2. She appealed dated 14 April 2021. She indicated that she proposed to provide a detailed appeal case bundle. She did however give her “top 10 grounds for appeal”. They are as follows: “I was not given a fair and reasonable opportunity to put my side of the story. Due process was not followed. Mitigating factors were not properly taken into account. new evidence is now available that could have altered the decision had it been presented on time. The penalty imposed is outside the band of reasonable responses. The decision made was based on misleading evidence, some of which was deliberately misleading. The chair of the panel was biased in that he had a personal dislike of me because I had questioned his capability in his data protection role at work and reported to the ICO (as a whistleblower) information governance errors he was responsible for. He should have stood down as the chair of the disciplinary panel as he had a clear and personal interest in dismissing me regardless of the principles of natural justice. The investigating officers involved presented information in a deliberately misleading manner, caused a personal data breach and failed to gather all the relevant evidence available to provide a more accurate view. They also refused to disclose, along with their HR colleague and Paul Fletton, secret guidance for managers that they used but did not share with me. At the behest of Laurel Penrose and named others, a campaign to victimise me was initiated and enacted because of the bad practises I had exposed at work as a whistleblower under the public interest disclosure act. Reasonable adjustments were not made to grant me enough time to research and prepare an effective defence (English is not my first language), nor to help me deal with the high levels of stress and anxiety I have suffered through being bullied at work for well over a year.” (375/382) 4.3. This was not presented as a comprehensive list. 4.4. The document does not engage with the reasons given by the disciplinary panel for the dismissal. 4.5. Mrs Jovcic-Sas does not say that she was dismissed because she had made protected disclosures (371 – 376). 4.6. A very substantial bulk of documents were ultimately provided for the appeal, an initial bundle of 93 pages, and further bundles, ultimately some 240 pages. 4.7. Amongst the documents, Mrs Jovcic-Sas identifies her concerns about Mr Fletton (584/591). “…Paul also demonstrates his tendency to select information which he then quotes out of context in order to make a point that he has already pre- determined. He is the individual who has refused my lawful requests for information that I needed to strengthen my case against his thinly veiled prejudice. He is the one who declared that my requests for personal information were not relevant to my case. He was the one who wrote me a poorly disguised ‘anonymous’ threatening letter making a range of malicious falsehoods about my bona fide requests for personal data. He is the one presiding over a data protection office that has consistently failed to redact personal data from confidential information and has been reported to the Information Commissioner's Office. He is the one who misquotes correspondence with me in an attempt to show me in a bad light when the shade should be cast on him. The above is an outline of why I questioned Paul's impartiality when it comes to chairing a disciplinary panel considering dismissing me. The reasons for his potential bias against me are well documented and he should have stood down as chair of this particular panel. He has done his best to make sure that I did not have a fair opportunity to counter the trumped up charges against me, with a mixture of misinformation, obstruction and bias - victimisation on an epic scale” 4.8. This echoes points made the statement in support of her appeal at pages 514 – 522, where Mrs Jovcic-Sas reports Paul Fletton as unfairly denying her documentation and responses to relevant SAR and FoI requests (521). We have not been taken to documentation in support of those allegations. 4.9. The hearing took place on 3 June. Mrs Jovcic-Sas attended only to have a written statement read and then left with her union representative. That was at her election. 4.10. In giving the outcome, the panel summarise the grounds for appeal, based on, “3 principal categories of grounds for appeal discussed with you and Alan before you left the Hearing. These relate to, 1) The admission of new evidence 2) Any part of the disciplinary process was wrong; and 3) Consideration as to whether the disciplinary outcome was proportionate.” (614/621) 4.11. The overall decision was upheld. 4.12. In relation to the first finding of the disciplinary panel in relation to the failure to destroy the data sent to her the appeal panel upheld the disciplinary panel's finding. They say this, “A refusal to carry out the reasonable order of a manager is an example of misconduct under the College’s disciplinary policy. However, we consider your refusal in the circumstances to be very serious. You were asked by the College, and informed that the ICO had also requested, for the information to be deleted. This was requested on numerous occasions. On two occasions you dishonestly informed the College that this information had been deleted. Therefore not only did you not follow the reasonable order of a manager full, but you were dishonest as to whether you had done so. For us, this significantly increases the seriousness of this offence, given that “making a false statement of any kind” is a further example of misconduct under the College’s disciplinary policy.” 4.13. The panel did not uphold the panel's finding in relation to Peter JovcicSas’ involvement in the safeguarding referral. They accepted that he made the initial telephone call and concluded there was insufficient evidence that Mrs Jovcic-Sas had discussed the student’s personal information with him. 4.14. They did find that she had failed to comply with the College’s safeguarding policy and procedures by not having reported prior to October 2020 in spite of considering a student to be at risk on at least eight occasions since February 2020. Breaking safeguarding rules is an example of gross misconduct in the disciplinary policy. They confirm the finding of the disciplinary panel. 4.15. The appeal panel did not uphold the allegation that Mr Jovcic-Sas had sat in on the disciplinary hearing, finding that she had not been given an adequate opportunity to explain her position in respect of his potential involvement or presence in the investigation meeting before it appeared as an allegation. 4.16. The gross misconduct dismissal was confirmed, therefore, on the basis of Mrs Jovcic-Sas’ mishandling of the badly redacted documents, refusal to delete and dishonesty over that refusal, and the failure to follow the College’s safeguarding policy by reporting any concern to the Safeguarding Team. 4.17. The panel confirm in the outcome letter their consideration of alternative sanctions but conclude that given the seriousness of the findings, whereby not reporting safeguarding concerns without delay, and repeated dishonesty as to whether Mrs Jovcic-Sas had deleted the information as she had been requested, dismissal was the appropriate sanction (616/623). 5. Law Unfair Dismissal 5.1. By section 98(1) of the Employment Rights Act 1996 (“the ERA”), it is for the employer to show - “a) the reason (or, if more than one, the principal reason) for the dismissal, and b) that it is either a reason falling within subsection (2) or some other substantial reason of a kind such as to justify the dismissal of an employee holding the position which the employee held.” 5.2. A reason falls within subsection (2) if it relates to the capability or qualifications of the employee for performing work of the kind which he as employed by the employer to do or which relates to the conduct of the employee. Misconduct is therefore a potentially fair reason for dismissal, as is lack of capability for the role. 5.3. By section 98(4), “Where the employer has fulfilled the requirements of subsection (1), the determination of the question whether the dismissal is fair or unfair (having regard to the reason shown by the employer) – a) depends on whether in the circumstances (including the size and administrative resources of the employer’s undertaking) the employer acted reasonably or unreasonably in treating it as a sufficient reason for dismissing the employee, and b) shall be determined in accordance with equity and the substantial merits of the case.” 5.4. First therefore the employer must establish the reason or principal reason for the dismissal and that it is a potentially fair reason. 5.5. Then the Tribunal must be satisfied that the employer has acted reasonably in treating the ground as a sufficient reason for dismissal. The Respondent must show that it had a genuine belief that the employee is guilty of misconduct, on reasonable grounds based on as much investigation as was reasonable (British Home Stores v Burchell, [1980] ICR 303). The misconduct must be shown to true in fact or believed to be true on reasonable grounds (W Devis & Sons Ltd v Atkins [1977] AC 931, [1977] 3 All ER 40 HL) If there are no reasonable grounds for a belief relied on as an important part of the reason for dismissal, the employer may be held not to have acted reasonably in all the circumstances in relying on it (Smith v City of Glasgow District Council [1987] IRLR 326, [1989] ICR 796, HL) 5.6. The question for the Tribunal is whether the employer has acted reasonably. The Tribunal is not entitled to substitute its own view for that of the employer, only to consider whether the employer’s actions fall within the band of reasonable responses ; that is, whether the employer acted reasonably and fairly in accepting the facts and beliefs that he did (Tayeh v Barchester Healthcare Ltd [2013] EWCA Civ 29, [2013] IRLR 387, CA) 5.7. In a conduct case, the test expressed as “the range of reasonable responses” applies both to the decision to dismiss and to the procedure by which that decision is reached (J Sainsbury plc v Hitt [2001] ICR 111). An employer need only adopt such procedural safeguards as a reasonable employer would adopt. 5.8. When it comes to the credibility of witnesses, what matters is the employer’s assessment of credibility and whether it is fair and reasonable, rather than that of the Tribunal, at this stage of the proceedings. 5.9. The Tribunal is not bound to hold that any procedural failure by the employer renders the dismissal unfair: it was one of the factors to be weighed up in deciding whether or not the dismissal is reasonable within s 98(4). The weight to be attached to such procedural failure should depend upon the circumstances known to the employer at the time of dismissal, not on the actual consequence of such failure. 5.10. In Polkey v AE Dayton Services Ltd [1988] ICR 142, the House of Lords confirmed that the question for the tribunal was whether the employer acted reasonably in the procedure adopted at the time. 5.11. In a suitable case, the employer may rely upon the breakdown in trust and confidence as a substantial reason justifying the dismissal. Usually that will apply where the breakdown arises out of the conduct of the employee. The employee cannot be fairly dismissed on the basis of personality alone. The Tribunal here may need to be prepared to consider the whole of the story, in order to fairly assess whether the reason is substantial and whether dismissal falls within s 98(4). Protected Disclosure 5.12. The provisions relating to protected disclosure are set out at sections 43A to 43K of the Employment Rights Act 1996. 5.13. By section 43B, “In this Part, a “qualifying disclosure” means any disclosure of information which, in the reasonable belief of the worker making the disclosure, is made in the public interest and tends to show one or more of the following – (b) That a person has failed, is failing or is likely to fail to comply with any legal obligation to which he is subject… and (d) That the health of safety of any individual has been, is being or is likely to be endangered….” 5.14. By section 43C, a qualifying disclosure is made, where the worker makes the disclosure to his employer. 5.15. A qualifying disclosure will have sufficient factual content and specificity to be capable of pointing to one of the qualifying categories in section 43B (Kilraine v Wandsworth LBC [2018] EWCA IRLR 846). The Tribunal must take into account the context and background. There is no rigid distinction between the provision of information on the one hand and the making of an allegation on the other (Simpson v Cantor Fitzgerald Europe CA [2021] IRLR 238). 5.16. The tribunal also considered in Chesterton Global Ltd v Nurmohamed [2017] EWCA Civ 979CA , considering the public interest requirement. There are four factors to be taken into consideration: the numbers in the group whose interests the disclosure served; the nature of the interests affected and the extent to which they are affected by the wrongdoing disclosed; the nature of the wrongdoing disclosed and the identity of the alleged wrongdoer. 5.17. Guidance is given from Blackbay Ventures Ltd (Chemistree) v Gahir UKEAT/0449/12/JOJ on the steps to be taken by the Tribunal.[1]Each disclosure should be identified by reference to date and content.[2]The alleged failure or likely failure to comply with a legal obligation, or matter giving rise to the health and safety of an individual having been or likely to be endangered or as the case may be, should be identified.[3]The basis upon which the disclosure is said to be protected and qualifying should be addressed.[4]Each failure or likely failure should be separately identified.[5]Save in obvious cases if a breach of a legal obligation is asserted, the source of the obligation should be identified[6]The Tribunal must then consider whether or not the Claimant had the reasonable belief referred to in section 43B(1) and whether it was made in the public interest. 5.18. By section 47B(1), “A worker has the right not to be subjected to any detriment by any act, or any deliberate failure to act, by the employer done on the ground that the worker has made a protected disclosure.” 5.19. “Worker” has the extended meaning given by section 43K. 5.20. By section 47B(1A), “A worker (“W) has the right not to be subjected to any detriment by any act, or any deliberate failure to ack, done –(a) By another worker of W’s employer in the course of that other worker’s employment, or(b) By an agent of W’s employer on the ground that W has made a protected disclosure. 5.21. In such a case, the detriment is treated as done by the employer (section 47B(1B). 5.22. Where the Tribunal finds a protected disclosure and detriment, the question is whether or not the detriment was “on the ground that” the worker has made the protected disclosure. The question there is whether the protected disclosure materially influences (in the sense of being more than a trivial influence) the employer’s treatment of the whistleblower. (Fecitt and others and Public Concern at Work v NHS Manchester, [2011] EWCA Civ 1190, [2012] IRLR 64. 5.23. By section 103A, an employee is to be regarded as unfairly dismissed if the reason or principal reason for the dismissal is that the employee made a protected disclosure. The burden is on the Respondent to establish the reason for the dismissal (Kuzel v Roche Products Ltd [2008] ICR 799). If the employer fails to do so, it is open to the employment tribunal to find that the reason is that asserted by the employee, but it is not bound to do so. The identification of the reason or principal reason turns on direct evidence and permissible inferences from it. 6. Submissions 6.1. Mr Jovcic-Sas and Mr Williams made written submissions which we have considered carefully and with equal care in making our findings of fact and in determining the issues.
The hearing
[8]Judgment 8.1. The Claimant’s claims of unfair dismissal, automatically unfair dismissal and detriment on the grounds of protected disclosure are dismissed.