Mr D Boucher v Essential Finance Group (UK) Ltd: 2407283/2021
EMPLOYMENT TRIBUNALS
Case No 2407283/2021
Between
Mr D BoucherClaimantEssential Finance Group (UK) LtdRespondent
Before
Employment Judge GannerDate 6 June 2022
JUDGMENT
[1]The claimant was unfairly dismissed by the respondent.[2]The claimant contributed to his dismissal to the extent of 20% to be applied to the basic and compensatory award for unfair dismissal.[3]The Tribunal will decide the remedy for unfair dismissal at a further hearing provisionally listed on 15 August 2022.
REASONS
[1]By a claim form presented on 24 May 2021 Mr Daniel Boucher, the claimant, complained of unfair dismissal from Essential Finance UK Group Limited.[2]By its response form the respondent resisted the complaint. Their position was that the claimant had been fairly dismissed for gross misconduct for breaching the company’s data protection policy and GDPR legislation by transferring client personal data to his own personal email.
The Issues
[3]The issues to be determined by the Tribunal were agreed at the outset of the hearing, as follows:(1) What was the reason for the dismissal?(2) Did the respondent genuinely believe on reasonable grounds that the claimant was guilty of the misconduct complained of?(3) Was there a reasonably fair investigation and procedure?(4) Did the decision to dismiss the claimant rather than impose some lesser disciplinary punishment fall within the band of reasonable responses? Non-disclosure/zero tolerance policy[4]Another issue emerged just before evidence was called. The alleged data breach had emanated from a telephone call between the claimant and a customer. The respondent had listened to the conversation (which had been recorded) during the disciplinary process.[5]However, despite being requested, a transcript of the call was not provided to the claimant neither at disciplinary nor pursuant to the Tribunal’s case management order requiring the parties to send relevant documents (including recordings) in their possession and control to each other. This order had been made on 21 June 2021.[6]The claimant had throughout contended that production of this material would assist his case that any transgression was a minor one and that there might additionally be further material that would show the respondent was aware of the conversation some time before he handed in his notice yet took no action.[7]I enquired why the recording had not been disclosed. Mr Wood, counsel for the respondent having taken instructions, told me that the material had not been given to the claimant at the time of the disciplinary proceedings as its contents had been disregarded as irrelevant to the outcome on the basis that the respondent had been operating a “zero-tolerance” policy. This took me by surprise as it was new information not in line with the respondent’s pleaded case nor the contract of employment and disciplinary policies. Counsel drew my attention to the fact Mr White had stated in his appeal letter (198) the call was “not fundamental to the disciplinary outcome”.[8]As to the failure to provide the material to the Tribunal, I was informed Mr White had given everything his then solicitors had asked for. It was accepted the respondent remained in breach of the order but contended the claimant was not prejudiced and could have a fair hearing. It was rightly conceded by the respondent that without disclosure, any version of the call given in evidence by the claimant to the Tribunal would have to prevail and could not be challenged.[9]I was concerned that the claimant may have been deprived not just of the benefit of a record of his conversation with the customer but also whether there had been non-disclosure of other material that might have assisted his case e.g., ( as contended by the claimant in his witness statement) whether the respondent had listened to the conversation well before he handed in his notice and chosen to take no action.[10]I considered whether to adjourn the matter to enable compliance to take place, but given the case was inevitably going to overrun, I decided the hearing should proceed thereby giving the respondent a further opportunity to comply before the hearing was resumed on 12 May 2022.[11]Nothing further was disclosed prior to the resumed hearing and the respondent remains in clear breach of the order. I did not consider it to be in accordance with the overriding objective to further adjourn the matter and decided it would still be possible for me to determine the outcome fairly and justly taking the non-compliance into account if necessary. Evidence and Witnesses[12]The respondent called two witnesses:(1) Mr Sean Watkins-Wilson, Business Director who made the decision to dismiss the claimant.(2) Mr Robert White, the Managing Director who dealt with the claimant’s appeal.[13]The claimant gave evidence on his own account.[14]There was an agreed bundle of documents which I treated as a witness statement as far as it dealt with factual matters and references to page numbers herein relate to that bundle. Relevant Findings of Fact[15]The relevant facts that led to the claimant’s dismissal were not in dispute and are as follows.[16]The claimant had been employed as a protection adviser since 11 June 2018 until 23 March 2021, the date of termination (211). His job was to provide clients with advice on suitable products to protect them from death and serious illness.[17]The claimant's employment contract (39) was signed on 16 June 2018 and required him to comply with the company’s rules and procedures set out in their handbook. Clause16.2.1 required him to comply with a privacy standard when handling personal data in the course of his employment, including personal data relating to any employee of the company. It also provided at16.2.2 that “acts in contravention of this standard could be dealt with under the disciplinary procedure and in serious cases may be the subject of gross misconduct and lead to summary dismissal.”[18]The disciplinary policy gives examples of conduct which will normally lead to formal disciplinary action being taken and at clause10.1 that summary dismissal will be the normal result for gross misconduct and at10.2 examples of such behaviour are given as including serious breach of confidentiality and failure to follow reasonable instructions (74)[19]The handbook was updated from time to time to reflect new GDPR and rules. The data protection policy within the handbook sets out these legal conditions in relation to the obtaining, handling, processing etc of personal information, and states, at 1.5 “compliance with this policy and any related company policies is mandatory and any breach of this policy or related company policies will be taken seriously and may result in disciplinary action” (128). The claimant accessed that new document on 27 June 2019 (155).[20]On 5 March 2021 (page 160) the claimant submitted his resignation to the respondent, having secured an offer of employment with another company, “That’s Life Group”. That company was in direct competition with the respondent. The respondent believed that the latter had been trying to poach staff.[21]It was agreed the claimant would work his notice. He was advised to act professionally, and all would be well. The respondent was not happy that they were losing a member of staff and asked him to reconsider his decision.[22]As part of the respondent’s policy in respect of leaving employees a search was conducted on each employee’s file of the email history. This was to ensure data protection and competition issues were identified if present. A chart explaining this process was in evidence (171). During this exercise it was discovered the claimant had sent client information to his personal email account on 19 November 2020 (159) The email in question was entitled “Bespoke Jewleer” (sic) and contained only the name of the customer, the name of his company and its business website address.[23]On 15 March 2021 Mr Watkins-Wilson handed the claimant a letter suspending him from work whist an investigation into his professional conduct was undertaken specifically regarding the allegation he had breached the company’s data protection policy and GDPR legislation by transferring client personal data to his own personal email which could amount to a criminal offence (163).[24]A review of the claimant’s email account and search histories took place to ascertain if any other data had been transferred from the business, and nothing further was identified.[25]On 17 March 2021 the claimant was invited to a disciplinary meeting (page 177) to answer the allegation that “you have breached the company data protection policy and GDPR legislation by transferring client personal data to your own personal email which could amount to a criminal offence under the GDPR regulations”. The claimant was told of his right to be accompanied to the disciplinary hearing and given documents regarding the disciplinary procedure. The letter stated that the allegations were very serious and could lead to his dismissal from the company on the grounds of gross misconduct and/or the instigation of criminal proceedings.[26]The hearing took place on 19 March 2021 (178-180) and Mr Watkins-Wilson heard from the claimant. The claimant did not consider there had been a GDPR breach but agreed he had forwarded the email to his personal account. He explained that having been told the customer was in the jewellery business he obtained the latter’s consent to contact him as he was looking to have a ring made up for his 10th anniversary. The claimant stated that as his phone was in his locker, he could not record the details there so he put them in an email to himself.[27]Mr Watkins-Wilson decided the allegation against the claimant was proven. He stated that he believed his actions had breached the privacy statement, employment contract and GDPR, that such breaches were serious and he took the decision to dismiss the claimant with immediate effect, agreeing however to pay his outstanding notice. The claimant was informed of his right of appeal within five working days.[28]The claimant indicated he would be appealing (179).[29]The letter confirming the disciplinary outcome (page 181) was sent on 23 March 2021. It summarised the minutes of the hearing which were enclosed.[30]The claimant provided written reasons in support of his appeal by way of a letter sent on 24 March 2021 (184-185). The letter complained that matters had not been properly investigated and that he had not been provided with the company’s data protection policy. The claimant said the consent of the customer had been provided verbally, that the information he had recorded was public information and the consent was obtained on a recorded call. He maintained that there had not been a serious breach of confidentiality amounting to an act of gross misconduct and sought to argue that a personal data breach had not occurred as his access to personal data had been authorised (by the customer). The claimant argued that if a serious data breach had occurred this would need to have been reported to the ICO within 72 hours, and the respondent had not done this nor contracted the individual concerned with the information.[31]The claimant also disagreed with the minutes reflecting the full conversation insofar as they failed to note and record his question as to whether the call recording had been listened to as part of the investigation, which he said Mr Watkins-Wilson had refused to answer in the disciplinary meeting, Given that the claimant had informed the respondent of this express consent in the investigation meeting, he regarded the failure to investigate this crucial point as being a fundamental flaw in the company’s investigation.[32]The claimant was provided with the data protection policy and employee handbook prior to the appeal, which took place before Mr Robert White, Managing Director, on 6 April 2021(186-187).[33]At the appeal hearing the claimant repeated his prior arguments that he did not believe what he had done had constituted a GDPR breach and Mr White responded that the breach alleged was not just a GDPR breach but a breach of the staff handbook and a contractual one.[34]Mr White sent a formal response by way of a letter dated 9 April 2021 (pages 192-199). He gave a full set of reasons for his decision to uphold the dismissal, which can be summarised as follows.[35]The business had a high level of compliance responsibility, including responsibility for the compliance of employees. The issue was that the claimant had breached the company’s data protection policy and GDPR legislation and that the name of the individual was indeed personal data and that both the company and its workers had responsibilities under data protection as to its use. He explained a personal data breach occurs whenever data is passed on without proper authorisation. Mr White stressed that the claimant had undergone annual refresher training on this subject and expressly told that under no circumstances should data be sent to his own personal email address, and that doing so could result in disciplinary action which could lead to dismissal. The claimant had undertaken this training both on 17 January 2020 and 5 January 2021.[36]In the 2020 refresher training he took a quiz to establish his understanding of various points. One question was “which of the following are types of financial crime?” and the claimant correctly circled answer (c), “emailing your personal account information”. Mr White explained how the handbook had been updated several times and the claimant had accessed these indicating he had read and understood the rules.[37]Mr White extensively referenced the written policies to illustrate what was considered to be a serious offence/gross misconduct. He summarised the position at 10.2 as follows by saying “there were several places in the disciplinary policy and procedure, where the company recognises this matter as a serious offence amounting to gross misconduct, because it is a serious breach of confidentiality breach of confidence relating to the company and a failure to comply with specific instruction and the company’s regulations”.[38]He also confirmed that “whilst this breach had been recorded, we do not believe the breach is of a material nature so the ICO and the individual affected have not been informed”.[39]Regarding the complaint the initial investigation was deficient, Mr White confirmed the call with the customer was listened to prior to the investigation meeting but was “not deemed fundamental to the disciplinary outcome as to whether or not consent was obtained from the client to use their data in a manner that was outside of Essential Insurances privacy policy”.[40]In Mr White’s view it was “clear” that a criminal offence (obtaining personal data without the consent of the controller) had been committed. He stated that due to the nature and severity of the incident the respondent was unable to ignore this. Although it was concluded the event was (as far as they could reasonably tell) an isolated one and they would not look to proceed with any form of prosecution, he felt that the investigation was fair, that due process had been followed and that the unfortunate outcome was correct and therefore upheld. Parties evidence to the Tribunal[41]In response to questions regarding the operation of a “zero-tolerance” policy, I find this was effectively confirmed by Mr Watkins-Wilson, the dismissing officer who stated that any breach would lead to dismissal. Mr White, who heard the appeal, also told me that dismissal would be inevitable but allowed for the possibility of a different outcome in the event of extreme mitigating circumstances of a personal nature, such as illness.[42]Mr White added that the claimant knew (and had been told along with other employees as part of their training) that dismissal would “more than likely” follow in the event of a data breach.[43]The claimant similarly gave evidence in accordance with his statement and re iterated his belief that dismissal would not have been the outcome if he had not given notice of his intention to leave and work for a rival. He believed the respondent was aware of the conversation with the customer well before his dismissal. He did not think his actions amounted to a serious disciplinary offence warranting dismissal and was never made aware of a zero-tolerance policy. In cross examination he conceded that the transferring of customer details to his personal email account was a breach of the respondent’s data protection policy and the GDPR legislation. He was questioned on procedural matters concerning him being properly informed and exercising his rights throughout the disciplinary process and conceded it was fair in several respects. I found the claimant to be a truthful witness. Relevant Legal Principles[44]The unfair dismissal claim was brought under Part X of the Employment Rights Act 1996.[45]The primary provision is section 98 which, so far as relevant, provides as follows: “(1) In determining for the purposes of this Part whether the dismissal of an employee is fair or unfair, it is for the employer to show –(a) the reason (or, if more than one, the principal reason) for the dismissal and(b) that it is either a reason falling within sub-section (2) or some other substantial reason of a kind such as to justify the dismissal of an employee holding the position which the employee held. (2) A reason falls within this sub-section if it … relates to the conduct of the employee … (3) … (4) Where the employer has fulfilled the requirements of sub-section (1), the determination of the question whether the dismissal is fair or unfair (having regard to the reason shown by the employer) – (a) depends on whether in the circumstances (including the size and administrative resources of the employer’s undertaking) the employer acted reasonably or unreasonably in treating it as a sufficient reason for dismissing the employee, and (b) shall be determined in accordance with equity and the substantial merits of the case”.[46]In a misconduct case the correct approach under section 98(4) was helpfully summarised by Elias LJ in Turner v East Midlands Trains Limited [2013] ICR 525 in paragraphs 16-22. Conduct dismissals can be analysed using the test which originated in British Home Stores v Burchell [1980] ICR 303, a decision of the Employment Appeal Tribunal which was subsequently approved in a number of decisions of the Court of Appeal. The “Burchell test” involves a consideration of three aspects of the employer’s conduct. Firstly, did the employer carry out an investigation into the matter that was reasonable in the circumstances of the case? Secondly, did the employer believe that the employee was guilty of the misconduct complained of? Thirdly, did the employer have reasonable grounds for that belief?[47]Since Burchell was decided the burden on the employer to show fairness has been removed by legislation. There is now no burden on either party to prove fairness or unfairness respectively.[48]A fair investigation requires the employer to follow a reasonably fair procedure. By section 207(2) of the Trade Union and Labour Relations (Consolidation) Act 1992 Tribunals must take into account any relevant parts of the ACAS Code of Practice on Disciplinary and Grievance Procedures 2015.[49]If the three parts of the Burchell test are met, the Employment Tribunal must then go on to decide whether the decision to dismiss the employee was within the band of reasonable responses, or whether that band fell short of encompassing termination of employment.[50]It is important that in conducting this exercise the Tribunal must not substitute its own decision for that of the employer. The band of reasonable responses test applies to all aspects of the dismissal process including the procedure adopted and whether the investigation was fair and appropriate: Sainsburys Supermarkets Ltd v Hitt [2003] IRLR 23. The focus must be on the fairness of the investigation, dismissal and appeal, and not on whether the employee has suffered an injustice. The Tribunal must not substitute its own decision for that of the employer but instead ask whether the employer’s actions and decisions fell within that band.[51]In a case where an employer purports to dismiss for a first offence because it is gross misconduct, the Tribunal must decide whether the employer acted reasonably in characterising the misconduct as gross misconduct, and also whether it acted reasonably in going on to decide that dismissal was the appropriate punishment. An assumption that gross misconduct must always mean dismissal is not appropriate as there may be mitigating factors: Britobabapulle v Ealing Hospital NHS Trust [2013] IRLR 854 (paragraph 38). Submissions Respondent’s Submissions[52]For the respondent, Mr Wood submitted that the stated reason of the claimant for dismissal was fair and reasonable in all the circumstances under section 98(4) of the Employment Rights Act 1996, that the respondent genuinely believed on reasonable grounds that the claimant was guilty of misconduct and a fair procedure had been followed. In terms of the zero tolerance policy, Mr Wood argued this had been sufficiently brought to the claimant’s attention on the basis of the training that had been given on this topic, the content of the quiz in which the claimant acknowledged the potentially serious criminal nature of a transfer of information to a personal email address and warning that Mr White had previously given to employees including the claimant that dismissal would more than likely result from a breach of the policy. Claimant's Submissions[53]Mr Boucher maintained the dismissal was something of a contrivance as the respondent was not happy he was going to work for a competitor and they did not want to pay his bonus. Having originally contended no data breach had occurred, he realistically accepted there had made a transfer of data which gave the respondent a basis for their belief in the breaches alleged. His principal argument was there had been an unfair procedure insofar as he was not made aware of a zero-tolerance policy and that in any event he was dealt with far too harshly given the innocuous nature of the transferred data which caused little risk to the respondent and none to the data subject who positively consented to his details being provided to the claimant. He also submitted no proper consideration had been given to the fact that the breach had taken place 5 months before he gave his notice, that the investigation an unearthed nothing else untoward and that no or insufficient account was taken of his clean record. Conclusions (1) What was the reason for the dismissal?[54]The respondent must show a potentially fair reason for dismissal. This was not seriously in dispute and it is my finding that the respondent did consider and has shown the reason for dismissal related to conduct namely a breach of company data protection policy and GDPR legislation by transferring client personal data to his own email. (2) Did the respondent genuinely believe on reasonable grounds that the claimant was guilty of the misconduct complained of?[55]The respondent’s witnesses held a genuine belief that the claimant was guilty of misconduct. They gave clear evidence to this effect in the dismissal and appeal letters, together with their understanding of the applicable GDPR legislation and company policies. This evidence was sufficient to base and sustain their reasonable grounds for their belief in the claimant's guilt. (3) Was there a reasonably fair investigation and procedure?[56]The outcome was decided on the basis of a policy that had not been shown to the claimant and of which he was therefore unaware. This position was at variance with the respondent’s written policies that serious breaches of discipline may be treated as gross misconduct, which would then normally result in dismissal.[57]I reject Mr Wood’s submission that Mr White’s “more than likely” exhortation and the claimant's answers to the quiz provide a sound basis to conclude the policy had evolved to the zero-tolerance one presented to the tribunal.[58]Had the claimant then been told his “defence” to the disciplinary charge was irrelevant to the outcome, he would have had an opportunity to argue his case to the respondent with that in mind. In the event he was only told upon receipt of the appeal notification that the recorded call was “not fundamental” to the outcome, by which time it was too late.[59]The above situation led to a failure by the respondent to consider the relevant circumstances and a denial of natural justice which took its procedure outside the band of reasonable responses that applies to this aspect of the disciplinary process. Sanction[60]Alternatively, if I am wrong about the dismissal being unfair on procedural grounds, I consider what Mr Wood described as the “overlapping” issue of sanction.[61]I must decide whether a reasonable employer might reasonably have dismissed the claimant in response to his conduct. How I would have handled the situation is irrelevant.[62]The relevant question is posed by section 98(4)(a) of the Employment Rights Act 1996 and is answered by looking at what a reasonable employer might decide. Whatever the policy, a reasonable employer would have considered the relevant circumstances which here were that a valued employee, who was performing well, took down the name and address website of a customer (data subject) with his consent to possibly get a ring made up for his wife. This was an isolated incident which was not deemed sufficiently serious to notify the Information Commissioner or the police. No harm was done nor was intended to be done to the company and the claimant had a clean record.[63]The question as to whether the claimant's actions were gross misconduct was a relevant consideration but not a decisive one when considering whether the dismissal was unfair. On the facts found I have simply approached the matter by examining whether a reasonable employer would have disregarded the above considerations or applied proper weight to them. It should have done the latter. To be clear, the respondent, in determining sanction, failed to consider the circumstances of the offence and failed to have regard to the claimant’s unblemished record.[64]I find no reasonable employer would have dismissed the claimant given proper consideration of the above circumstances. Contributory fault Relevant Law and
Conclusions
[65]Given the claimant’s breaches of the rules, the question of contributory fault arises. The Tribunal may reduce the basic and/or compensatory awards for culpable conduct in the slightly different circumstances set out in sections 122(2) and 123(6) of the Employment Rights Act 1996. Section 122(2) provides as follows: “Where the Tribunal considers that any conduct of the complainant before the dismissal (or, where the dismissal was with notice, before the notice was given) was such that it would be just and equitable to reduce or further reduce the amount of the basic award to any extent, the Tribunal shall reduce or further reduce that amount accordingly.”[66]Section 123(6) then provides: “Where the Tribunal finds that the dismissal was to any extent caused or contributed to by any action of the complainant, it shall reduce the amount of the compensatory award by such proportion as it considers just and equitable having regard to that finding.”[67]Mr Wood argued that the claimant's conduct was clearly blameworthy and obviously caused or contributed to the dismissal. He contended that it was just and equitable to make a significant reduction to the basic and compensatory awards in the circumstances of this case. The claimant contended that the matter was of little consequence and that no or little contributory award should be made.[68]Whilst in one sense the mere taking down of the business website of a company for the innocuous purpose of buying a ring could be considered a trivial matter, it was not trivial in terms of the adherence to the rules set out in the respondent’s policies. In particular, given the claimant’s experience he should have exercised greater responsibility and self-discipline when making his decision to send an email to himself. He knew that this was against the company rules, although I accept he may have wrongly believed there was no data breach given the consent of the data subject.[69]Given the low-level nature of the breach and the claimant's good record, I reduce the basic and compensatory award by 20% to reflect his culpability.