Mr Andrew Cox v Southampton City Council: 1403924/2018
JUDGMENT
[1]The Claimant’s unfair dismissal claim succeeds.[2]There is to be a reduction of 20% for contributory fault to any remedy awarded.[3]A remedy hearing will be listed as soon as convenient to the parties and the Tribunal.REASONS
[1]Mr Cox was employed by the Southampton City Council until his dismissal on 10 September 2018. His role was Finance Analyst, and he had been employed by the Council since 2001. He complains he was unfairly dismissed and seeks compensation for that unfair dismissal.[2]In the course of the case, I have been directed to pages in an agreed bundle of documents. I have also heard evidence from the following individuals :(1) Mr Steve Smith, the investigating officer;(2) Ms Mel Creighton, the dismissing officer;(3) Mr Cox, the Claimant. Procedural matters[3]The Tribunal had not sent the parties automatic directions setting a timetable for the preparation of the case for this hearing. This was because Mr Cox had originally included a discrimination claim, which he later withdrew. Had the discrimination claim remained, the Tribunal would have planned to have a telephone directions hearing. When the discrimination claim was withdrawn, and therefore a telephone directions hearing was no longer needed, the Tribunal failed to send out written directions to the parties.[4]As a result, the Respondent took the initiative to prepare a bundle for the hearing, which was sent to Mr Cox last Wednesday, just over a week ago. At the same time, the Respondent sent the Claimant its written statements of the two witnesses it intended to call. No prior discussion had taken place between the parties as to a date for exchange of witness statements.[5]In the week since he received the bundle, to his credit, Mr Cox suggested further documents to be added to the bundle (which were included), and wrote down his own thoughts as to the unfairness of his dismissal. He brought that document to the Tribunal this morning. By agreement it was photocopied and treated as his witness statement. It cross-refers to several pages in the bundle. In many respects it is as if it was a witness statement. He confirmed its truth on affirmation when he came to give his evidence.[6]The tribunal took time to read the witness statements and the documents to which they cross-referred. On resuming at 12.15pm, Miss Athill, counsel for the Respondent made an application for a postponement on the basis that the Respondent had been taken by surprise by the contents of Mr Cox’s witness statement, which they had only seen for the first time on that day. Given the points made, Miss Athill argued that time was needed to take full instructions and decide whether further witnesses should be called to deal with the matters in the witness statement.[7]I decided that the fair way to proceed was to delay the start of the evidence until 3pm to allow both sides time to prepare further. Evidence would then be heard from the Respondent’s witnesses on the first day, with the Claimant giving his evidence on day 2. In that way, the claim could proceed to a resolution within the two days allocated. That is what was achieved. The tribunal sat until 5.30pm on the first day to complete the Respondent’s evidence. The Respondent’s witnesses were not able to attend on the second day. Overview[8]The stated reason for Mr Cox’s dismissal was gross misconduct. It was part of his job as a Finance Analyst to send to the website team a spreadsheet recording transactions where the Council had spent more than £500. This spreadsheet would ordinarily contain personal details disclosing the identity of those who had benefited from this expenditure. It was his responsibility to remove those personal details before forwarding to the website team so that they would not be published on the website.[9]Mr Cox accepts that he made a mistake in failing to have this information removed. His position is that the sanction of dismissal is a disproportionate one, in that his mistake was not sufficient serious to merit dismissal. He also complains about his suspension and the manner in which this was communicated to him, the disciplinary investigation and the late stage at which he was provided with evidence and asked to respond. Legal principles[10]Where an employee has been dismissed for gross misconduct and alleges that his dismissal has been unfair, the Tribunal needs to consider various sequential issues in order to assess whether the Claimant’s claim should succeed.[11]Firstly, did the dismissing officer genuinely believe that the Claimant was guilty of misconduct ?[12]Secondly, was that belief a reasonable one, reached after a reasonable investigation ?[13]Thirdly was dismissal a fair sanction for the alleged misconduct, and was that reached after a fair procedure ? In these respects, it is not for the Tribunal to substitute its own conclusion as to the sanction or the procedure followed. Rather, it is to view the sanction of dismissal for the misconduct alleged and ask whether the sanction fell within the band of sanctions that a reasonable employer could impose for this misconduct. In relation to the procedure, the Tribunal is to ask whether the procedure followed fell within the band of reasonable procedures that could have been adopted by a reasonable employer, given the misconduct in issue.[14]In assessing the reasonableness of the procedure and the sanction, the Tribunal will have regard to the employer’s own disciplinary policy, both in terms of what the employer had previously stated it would regard as gross misconduct, but also in terms of the procedure that the employer has said it would follow in such cases. It will also have regard to the ACAS Code of Conduct on Disciplinary Procedures and the associated ACAS Guide. Relevant policies[15]The Council’s disciplinary policy was issued in July 2016 and updated in July 2017. It does not set out any examples of misconduct that will be regarded as misconduct or as gross misconduct. That is only done in the Disciplinary Policy and Procedure – Manager Guidance, issued in September 2016. That is a document Mr Cox was never shown in advance of the matter for which he was being disciplined.[16]The Manager Guidance document lists the following matters as examples of ‘misconduct’ as opposed to ‘gross misconduct’ :a. Failing to comply with the Code of Conduct;b. Failing to comply with a reasonable management instruction;c. Failure to observe the Council’s ICT standards, policies and guidance on the use of IT facilities.[17]The following matters are listed as gross misconduct :a. Under the heading “Breach of Trust”, omission or conduct liable to lead to serious loss of confidence in the public service;b. Under the heading “Confidentiality”, unauthorised disclosure of confidential and personal information including that which may be of use to a competitor within a tendering situation or quotation procedure.c. Under the heading “Use of Information Communications Technology Systems”, breach of the Council’s Information Systems Security Policy, Email and Internet Standards and Security Policy, or any other Standards and Policies relating to the use of information systems.[18]Aside from the general heading Confidentiality, there is no specific example given in this Manager’s Guide in relation to potential misconduct for misusing personal data concerning other employees or those for whom the Respondent was providing services.[19]I have been provided with a version of the Respondent’s Code of Conduct in the bundle of documents. However, the version provided was dated June 2018 and therefore postdates the matter for which the Claimant was disciplined. Only the odd numbered pages were in the original bundle and a complete set of pages was only provided at the start of the second day of evidence. This was after the Respondent’s witnesses had given their evidence and were no longer available to be questioned. It is not clear to what extent the version that was applicable in January 2018 differed from the version that was included in the bundle.[20]I suspect that the previous version may well have included different provisions in relation to the confidentiality of data, given that this version refers to GDPR, which was only implemented in May 2018, and was not in force in January 2018, at the time of the disciplinary issue that led to the Claimant’s dismissal.[21]As a result, I cannot give any weight to the document produced because I have not been provided with the document that was in force at the relevant time.[22]At the time, the Respondent had a Data Handling policy (dated July 2016) which stated that its purpose was to ensure that the highest standards of information security are maintained across the Council at all times so that the public and all users of the Council’s information systems are confident that information given to the Council will be looked after securely and used according to legal guidelines. The policy went on to say that managers have a responsibility to ensure that their employees understood and complied with this policy, and to ensure that their employees knew how to handle information appropriately. The policy does not warn that those mishandling confidential data were liable to be disciplined, nor does it warn of the risk of dismissal in appropriate cases.[23]The ACAS Code of Practice includes the following paragraphs : Para 23 : Some acts, termed gross misconduct, are so serious in themselves or have such serious consequences that they may call for dismissal without notice for a first offence. But a fair disciplinary process should always be followed, before dismissing for gross misconduct. Para 24 : Disciplinary rules should give examples of acts which the employer regards as acts of gross misconduct. They may vary according to the nature of the organisation and what it does, but might include such things as theft or fraud, physical violence, gross negligence or serious insubordination.[24]I have also had regard to the section of the ACAS Guide headed “What should be considered before deciding any disciplinary penalty?”. The ACAS Guide lists examples of gross misconduct. It says that “acts which constitute gross misconduct must be very serious and are best determined by organisations in the light of their own particular circumstances”. Relevant to the present case, the examples are “bringing the organisation into serious disrepute”; “causing loss, damage or injury through negligence”; or “a serious breach of confidence”. Factual findings[25]In his role as Finance Analyst, one of Mr Cox’s duties was to send information to the web team for publication on the website. In particular he was required to send information where the Respondent had spent more than £500 on a particular transaction. The procedure for doing so was documented in a 20 point procedure, set out at B/23 and B/24 in the bundle. The procedure is referred to as the Transparency procedure for spending over £500. In particular he was required to remove personal data that could identify names, addresses and contact details.[26]This was not a task he had been required to perform in his previous role of Accounting Technician. He had received general training in data protection as part of his role as a Council employee, although the details of that training are unclear. He had been in the role of Finance Analyst since July 2018 and had had some involvement in the production of Q1 and Q2 figures to the web team. It was his involvement in sending the Q3 figures to the web team that was alleged to be gross misconduct and the grounds for his dismissal.[27]Mr Cox sent information to the web team on 31 January 2018, purportedly in accordance with the transparency process. He sent it password protected, as the procedure required. He was asked for the password and sent the password to the website team by return. Whilst his decision to supply the password on email has been criticised, this was not a matter for which he was subsequently disciplined – although it was referred to in the disciplinary outcome letter. It was his failure to redact personal details before they were supplied to the web team.[28]The web edit team uploaded the information to the website. When it was uploaded, early in February 2018, the password was still attached to the document. As a result, none of the contents of the document could be viewed by members of the public. On about 7 March 2018 a member of the public contacted the Council to ask that the password be removed. It was removed and for a period of about 7 days, confidential information was published on the Council’s website. The information that was published was as follows :a. Names of families re-homed in temporary accommodation;b. Addresses where disabled adaptations had been made to properties;c. Names of agency workers and the amounts that they had been paid.[29]During this period the personal details were apparently viewed four times by members of the public. There was reference in evidence to a potential article in a local newspaper about the breach. However, this article was not referred to during the course of the disciplinary investigation, was not sent to Mr Cox in advance of the disciplinary hearing as part of the disciplinary pack, and was not referred to in disciplinary outcome letter. It was referred to in passing in the appeal outcome letter. It was not referred to in either of the Respondent’s witness statements nor has it been included in the bundle. Given its shadowy existence, I have disregarded it. On the evidence before me, the consequences of Mr Cox’s mistake is that personal data was viewed by four members of the public, one of whom appears to have complained.[30]On 14 March 2018, the data breach was reported by a member of the public and the confidential information removed from the website. The breach was reported to the Information Commissioner’s Officer, who decided not to take any further action. In their email in response, the ICO described the significance of the issue in the following terms : Although a large number of individuals have been affected, the personal data is limited in scope. Some sensitive personal data may have been disclosed indirectly and this incident had the potential to cause some distress and to possibly identify vulnerable individuals. However the data disclosed is probably lacking sufficient detail to cause significant detriment to the data subjects. Once the breach became known, the spreadsheet was immediately removed from the Council’s website.[31]An internal investigation was started at the end of March. The investigating officer, Mr Steve Smith, was a fourth tier officer within the council. He interviewed potentially relevant witnesses and prepared an interim report on 25 April 2018. At that point he had not interviewed the Claimant, who was on sick leave. Mr Cox’s sick leave started on 5 April and continued until the end of April. Mr Smith made five recommendations, including that the Claimant should face potential disciplinary action. The first four recommendations related to putting in place further internal controls to prevent personal data being inadvertently disclosed as a result of the error of a single employee.[32]In the meantime, on 1 May 2018, Mr Smith had been suspended on full pay. The reason why he had not been suspended earlier is that he had been signed off sick. Mr Smith continued his investigations, eventually preparing a further investigatory report, this time in advance of a disciplinary hearing. In advance of that investigatory report, he had interviewed the Claimant on two occasions and spoke to the witnesses he had previously interviewed, raising with them matters that had arisen from his interview with the Claimant. In his second interview, on 14 June 2018, Mr Cox referred to the pressures he was under at home by way of mitigating circumstances and by way of explanation for his mistake. In essence, he said that there were difficulties at the time with childcare for his one year old child, his wife had been signed off sick, there was a lot of stress at home which he described as “hell”, and said that this had affected his performance at work.[33]He said that it had been raised with his line manager at the time, and there is some support for this in the 1-2-1 from 11 January 2018. The notes document him telling his line manager that there was a lot going on with home life so he needed to have a phone readily available. He had requested working reduced hours and this request was about to be formalised.[34]At the end of this second investigation report, Mr Smith’s conclusion was that a disciplinary sanction should be imposed on Mr Cox, and that sanction should be one of dismissal. Mr Smith said that it was standard practice to suggest a disciplinary station in his experience. However this appears to depart from the Manager Guidance given to investigators [C/14] which states that : During the investigation, Investigating Officers need to remain impartial, guard against making assumptions and should avoid giving personal opinions, getting involved in arguments, or making personal remarks. It is important to look for evidence that supports the employee’s case as well as evidence against it. At the end of the investigation, Investigating Officers should summarise their factual findings in a report. This report will be used to decide whether there is a disciplinary case to answer and will form the basis of the evidence presented at any disciplinary hearing that follows.[35]There is no reference in this guidance to the Investigating Officer setting out his personal opinion on the sanction that should be imposed. That step appears to be contrary to the Manager Guidance.[36]The disciplinary hearing was due to be conducted by Ms Mel Creighton. She was a third tier officer, in that her line manager reported to the Council’s Chief Executive. She wrote to Mr Cox on 16 July 2018 inviting him to a disciplinary hearing to answer the following disciplinary charges: You failed to follow the correct procedure which resulted in a significant amount of personal data being available for viewing by the general public. That you were responsible for a data breach by allowing the transparency spend for transactions over £500 for quarter 3 (October to December 2017) to be published on the council’s website without personal identifying data being redacted.[37]On 30 or 31 July 2018 the disciplinary bundle was hand delivered to Mr Cox’s home address by Mr Smith. He did so at 8am in the morning, having sent an email an hour or so earlier to warn of his arrival. He had to ring the doorbell because the volume of papers was too large to fit through the letter box.[38]That hearing was postponed on three occasions – the first hearing because the Claimant’s chosen representative was unable to attend on 31 July 2018. The second hearing scheduled for 6 August 2018 was postponed because Mr Cox had been signed off work with depression and anxiety. By 29 August, the third date for the hearing, the Council had not yet received the occupational health report. It was rescheduled for a fourth time to be held on 10 September 2018. Mr Cox did not attend as he continued to be signed off work on sick leave. Mr Cox had asked for the occupational health report to be sent to him first before it was sent to the Council. When it arrived with him, he took issue with certain passages in the report. As a result, the report was not sent to the Council in time for the rescheduled disciplinary hearing on 10 September 2018. The decision was taken to proceed with the hearing in the Claimant’s absence, given that the previous letter had made it clear that the hearing would proceed on 10 September whether or not the Occupational Health report had been received. As a result, the Council did not have any occupational health advice before it took the decision to dismiss.[39]Ms Creighton conducted the disciplinary hearing in the Claimant’s absence. She heard evidence from Mr Smith who presented his investigation report. Whilst she noted Mr Smith’s recommendation as to the disciplinary sanction, I am satisfied that she exercised her own judgment in deciding how the disciplinary matter should be resolved. As part of this decision-making, she considered the mitigating circumstances put forward by Mr Cox, as explained in her management report prepared in relation to Mr Cox’s appeal. Despite these mitigating circumstances she considered that the appropriate outcome was for Mr Cox to be dismissed.[40]Mr Cox appealed against the decision to dismiss him on grounds detailed in a letter dated 13 September 2018. The appeal meeting was scheduled to take place on 15 October 2018. Mr Cox did not attend and the hearing went ahead in his absence. On the same day, 15 October 2018, Mr Cox was sent a written outcome letter dismissing his appeal. The letter ran to seven closely typed pages and addressed each of Mr Cox’s grounds of appeal.Conclusions
[41]I conclude that Ms Creighton did have a genuine belief in Mr Cox’s guilt. He admitted that he had sent unredacted personal data to the web team for publication on the website.[42]This belief was reached after a reasonable investigation. Mr Smith interviewed relevant witnesses asking relevant questions about the procedure for publishing details of expenditure over £500, suitably redacted. It was within the band of reasonable procedures for Mr Smith to interview others before he interviewed Mr Cox.[43]A fair procedure was followed in advance of the disciplinary hearing. It was appropriate for Mr Smith to hand deliver the hearing bundle to Mr Cox’s home address in circumstances where Mr Cox had not previously asked him not to do so. By so doing, Mr Cox had the papers in very good time in advance of the proposed disciplinary meeting. It was appropriate for Ms Creighton to conduct the disciplinary hearing in Mr Cox’s absence on 10 September 2018. It had been previously rescheduled on three occasions, twice to accommodate Mr Cox’s health. Ms Creighton had not received the advice from occupational health in advance of the disciplinary hearing. The correspondence had previously warned Mr Cox that the hearing would proceed in his absence if occupational advice was not produced. The delay in providing occupational health’s view, was down to Mr Cox, who had asked for changes to be made to the first draft of the report.[44]However, the sanction of dismissal was outside the band of reasonable sanctions given the extent of the misconduct. No reasonable employer would have dismissed Mr Cox for this misconduct, given the following features :a. Mr Cox’s mistake was an inadvertent failure to follow the designated procedure. It was not deliberate, and whilst it my be regarded as negligent, it could not fairly be described as gross negligence;b. He had not been warned in any training or any documented policy that a failure to follow this particular procedure was liable to lead to gross misconduct. Ms Athill submits that the Respondent placed a particular emphasis on the high importance of keeping private information confidential – but this alleged emphasis is not particularly reflected in the Council’s policies;c. Indeed Mr Cox had been given no examples of what amounted to gross misconduct in advance of the incident;d. The Manager’s Guidance details failure to comply with a reasonable management instruction as misconduct, rather than gross misconduct;e. Although Mr Cox had given the impression that he was fully familiar with the transparency procedure, it was a procedure that he had only carried out himself once before without supervision. Even then, it turned out that he had made mistakes in relation to the Q2 data that was provided;f. There were further controls that could have been introduced to stop inadvertent mistakes from happening in the future. These controls were recommended as the outcome of Mr Smith’s investigation;g. So far as the consequences of the mistake were concerned, those consequences were fortunately limited. The data had been viewed by only four members of the public. The ICO did not regard the breach as particularly serious. There is no evidence of any significant impact on the reputation of the Respondent and no evidence of any particular loss or damage to a member of the public;h. There were mitigating circumstances provided by Mr Cox in terms of the significant stress he was under in his personal life as a result of his wife being ill and difficulties in arranging childcare;i. Mr Cox had always accepted that he made a mistake in failing to redact the personal information. Whilst Mr Cox had not volunteered he was remorseful for his mistake, he had indicated he was aware of the potential consequences of his actions or willing to bear some responsibility for them. As he did not attend the disciplinary hearing, he did not have the opportunity to express remorse during this hearing;j. Mr Cox had been an employee of the Respondent for 17 years. During that time he had a unblemished disciplinary record and there was no proper basis for thinking that this isolated mistake was liable to repeat itself if Mr Cox received a sanction less than dismissal.[45]However I do regard Mr Cox’s mistake as amounting to contributory conduct for which there should be a reduction to the basic and compensatory awards. He knew the procedure to be followed, and accepted that he was capable of identifying personal data and ensuring that this personal data was redacted. Aside from his personal circumstances, he cannot provide a further explanation for why he failed to carry out an essential element of his job. Whilst I bear in mind the mitigating personal circumstances in his case, I consider that the appropriate reduction is one of 20%. It would not be appropriate for the reduction to be any higher than this in circumstances where it is not clear on the evidence what suggestions if any had been made as to appropriate redactions.[46]For these reasons, the claim succeeds, subject to a reduction of 20% for contributory fault. The appropriate remedy will need to be determined at a remedy hearing.[47]For the avoidance of doubt, I do not consider that there has been any failure to comply with the relevant ACAS procedures in terms of the processes that took place here. Therefore there is no adjustment to be made under Section 207A of the Trade Union and Labour Relations (Consolidation) Act 1992.Conclusions
[1]The Claimant is awarded the following sums by way of remedy for unfair dismissal :a. A basic award of £7,112, calculated as follows - 17.5 x £508 = £8,890 less 20% reduction for contributory fault.b. A compensatory award of £19,682.30, calculated as follows: i. Past loss of earnings and pension = £26,814.37 - £8,848.52 = £17,965.85; ii. Future loss of earnings and pension to 10 February 2020 = £20,006.51 - £13,369.48 = £6,637.03; iii. Total compensatory award before adjustment = £17,965.85 + £6,637.03 = £24,602.88; iv. £24,602.88 reduced by 20% for contributory fault is £19,682.30.[2]There is no protected period because the Claimant did not claim any benefits as Case No: 1403924/2018 a consequence of his dismissal.[3]The Respondent’s applications made under Rules 65 and 66 of the Employment Tribunal Rules 2013 that the Tribunal stay the judgment pending appeal or alternatively that Tribunal specify a later date for payment of the judgment sums than the default period of fourteen days specified in the Rules are both refused.