Mr R W Griffiths v The Chancellor, Masters and Scholars of the University of Cambridge: 3400184/2017

EMPLOYMENT TRIBUNALS

Case No 3400184/2017

Between

Mr R W GriffithsClaimant

The Chancellor, Masters and Scholars of the University of CambridgeRespondent

Before

Employment Judge Morron

Miss S Ismail (instructed by Counsel) for claimant

Ms A Reindorf (instructed by Counsel) for respondent

Date 16 November 2017

JUDGMENT

[1]The decision of the Tribunal is that the Claimant was not unfairly dismissed.

[2]The claim of wrongful dismissal/breach of contract is dismissed.

[3]The holiday pay claim was withdrawn and is dismissed by consent.

REASONS

[1]It was agreed by the parties in an Agreed List of Issues dated 19 June 2017 and confirmed at the start of the hearing that the matters for determination by the Tribunal were, first, the reason for dismissal and, if it was one which is potentially a fair reason to dismiss, whether in all the circumstances, the Respondent had acted reasonably or unreasonably in treating that reason as sufficient reason for dismissing the Claimant, having regard to equity and the substantial merits of the case.

[2]The parties agreed that there were a number of questions which the Tribunal would need to consider in making its determination which were set out as follows in paragraph 2(a) to (f) of the Agreed List of Issues:

[1]Was the dismissal procedurally fair? If not, was any procedural unfairness rectified by the appeal hearing?

[2]Was there sufficient investigation in respect of the allegations? If not, was any shortcoming in respect of the investigation rectified by the Respondent at either the disciplinary hearing and/or the appeal hearing?

[3]Was the decision to dismiss pre-determined?

[4]Did the Respondent consider issues of mitigation in respect of the Claimant’s conduct?

[5]Did the Respondent consider alternatives to dismissal?

[6]Did the Respondent’s decision to dismiss the Claimant fall within the range of reasonable responses available to it? 3. Whilst it was helpful to have an agreed list of issues the formulation of those issues must be read in the context of the relevant caselaw to which reference is made below. 4. The parties further agreed that if the Tribunal were to find that the dismissal was procedurally unfair it should go on to consider whether a reduction should be made pursuant to Polkey v A E Dayton Services Limited

[1987] IRLR 503

. 5. Furthermore, if the Tribunal were to find that the Claimant was unfairly dismissed, it should go on to consider whether the dismissal was to any extent caused or contributed to by any action of the Claimant pursuant to section 123(6) of the Employment Rights Act 1996 (“the Act”); and whether any conduct of the Claimant before dismissal was such that a reduction should be made in the basic award pursuant to section 122(2) of the Act. 6. The Tribunal will also have regard to the ACAS Code of Practice 1 on Disciplinary and Grievance Procedures (2015). By section 207A of the Trade Union and Labour Relations (Consolidation) Act 1992 as amended, the ACAS Code is admissible in Tribunal proceedings and the Tribunal is required to have regard to its provisions. Compliance with the Code is a relevant factor for the Tribunal to take into account when determining the fairness of a dismissal for the purposes of section 98(4) of the Act. Furthermore, if a dismissal is found to be unfair, section 270(A)(2) provides that if the employer has unreasonably failed to comply with the ACAS Code, the Tribunal may, if it considers it just and equitable in all the circumstances to do so, increase the compensatory award by up to 25%. There is a parallel obligation upon employees to comply with the Code and a parallel power to reduce the compensatory award by up to 25% for failure to do so.

[7]I heard representations on both Polkey and contributory conduct at the end of the hearing.

[8]In relation to breach of contract/wrongful dismissal the parties agreed that the issue is whether the Claimant’s conduct was such as to amount to a repudiatory breach of contract entitling the Respondent to terminate without notice or pay in lieu.

Relevant Law

[9]As indicated above, the formulation in the Agreed List of Issues is somewhat cryptic and must be understood in the light of the wording of the Act and the relevant caselaw.

[10]By section 94(1) of the Act an employee has the right not to be unfairly dismissed by his employer. Where a dismissal has taken place, section 98(1) provides that it is for the employer first of all to show, on the balance of probability, that the reason for the dismissal (or the principal reason if there is more than one) was either one of the reasons falling within section 98(2) or some other substantial reason. The potentially fair reasons falling within section 98(2) include conduct, which is the principal reason relied upon by the Respondent in this case. In the alternative, the Respondent relies upon some other substantial reason – essentially a breakdown in mutual trust and confidence.

[11]If the Respondent satisfies the Tribunal that the reason for dismissal is potentially fair, the Tribunal must go on to consider whether, in all the relevant circumstances (including the size and administrative resources of the Respondent’s undertaking), it acted reasonably or unreasonably in treating that as a sufficient reason for dismissal. This determination must be made in accordance with equity and the substantial merits of the case. It is particularly in this context that the Tribunal must have regard to the relevant caselaw.

[12]Unsurprisingly, both representatives referred the Tribunal to the oft-quoted case of British Home Stores Ltd v Burchell

[1980] ICR 303

in which the EAT set out three requirements of a fair dismissal in cases of alleged misconduct, namely that the Respondent must have a genuine belief that the Claimant was guilty of the misconduct alleged; that it had reasonable grounds for that belief; and that, at the time it held that belief, it had carried out as much investigation as was reasonable (i.e. as was within the range of reasonable responses open to a reasonable employer).

[13]The Tribunal must bear in mind that there is, in most situations, a range of reasonable responses open to a reasonable employer. The EAT, in Iceland Frozen Foods Ltd v Jones

[1983] ICR 17

, warned Tribunals against substituting their own decision as to what was reasonable for that of the employer. There will generally be cases where one employer might reasonable take one view and another might equally reasonably take a different view in the same circumstances. One may be relatively lenient and another relatively strict. The Tribunal’s role is to determine whether, in the particular circumstances of the case, the employer’s process and decisions fell within the range of reasonable responses available to a reasonable employer.

[14]This caselaw was revisited by the Court of Appeal in Graham v Secretary of State for Work and Pensions (Jobcentre Plus)

[2012] IRLR 759

in which Aitkens LJ gave further guidance with regard to the range of reasonable responses test. At paragraph 36 of his judgment he said this: “the ET must consider, by the objective standards of the hypothetical reasonable employer, rather than by reference to the ET’s own subjective views, whether the employer has acted within a “band or range of reasonable responses” to the particular misconduct found of the particular employee. If the employer has so acted, then the employer’s decision to dismiss will be reasonable. However, that is not the same thing as saying that a decision of an employer to dismiss will only be regarded as unreasonable if it is shown to be perverse. The ET must not simply consider whether they think that the dismissal was fair and thereby substitute their decision as to what was the right course to adopt for that of the employer. The ET must determine whether the decision of the employer to dismiss the employee fell within the band of reasonable responses which “a reasonable employer might have adopted”. An ET must focus its attention on the fairness of the conduct of the employer at the time of the investigation and dismissal (or any internal appeal process) and not on whether in fact the employee has suffered an injustice”.

Evidence

[15]At the hearing the Tribunal heard evidence from three witnesses on behalf of the Respondent: Professor R Fentiman, who chaired the disciplinary panel which decided to dismiss the Claimant; Professor A Parker, who chaired the appeal panel which upheld that decision; and Mr T Dampier, who carried out the investigation into the allegations of misconduct. The Tribunal heard evidence from the Claimant and two colleagues who had worked with him: Mr A Smith, a freelance programmer, and Ms L Timms, a former Project Assistant. Mr Dampier now works and resides in New York and gave his evidence by video link.

[16]All gave evidence in chief by previously prepared and exchanged written witness statements which were taken as read by the Tribunal and all were cross-examined by Counsel.

[17]The parties had agreed a Hearing Bundle comprising 615 pages in two files. During the hearing the Respondent produced a further document headed “Hands up Education”; and the Claimant produced an original copy of a letter from Brown Rudnick Solicitors dated 27 June 2016.

[18]I was given a chronology prepared by the Respondent’s Counsel at the start of the hearing and a Timeline prepared by the Claimant’s Counsel which she attached to her closing submissions and handed up at the end of the hearing. Both Counsel gave me written closing submissions to which they spoke.

[19]I have had regard to all the written and oral evidence and the submissions whether or not they are expressly referred to in my decision. Essential Findings of Fact

[20]This is a case in which the great majority of the facts are not disputed. There is a dispute as to what was said and agreed at a meeting on 24 June 2016 but other than that the essential facts are a matter of record. There is also a dispute between the parties as to how to describe accurately a disagreement between the Claimant and the Respondent’s technical advisers as to the extent, if any, of any risk to the Respondent arising out of the continued operation of a web-site and this is addressed below. Those matters apart, the essential facts are a matter of documentary record and not contested.

[21]The Claimant was first employed by the Respondent on 1 September 2000 as E-Tutor Co-ordinator for the Cambridge On-Line Latin Project. In September 2003 he was appointed Director of the Cambridge School Classics Project (“CSCP”), a post he held until his dismissal on 23 September 2016. His Line Manager was Professor Geoff Hayward, the Head of the Education Faculty, but he was given great autonomy to manage the CSCP and did so successfully in that it grew significantly over the period of his management. The project had first been established in 1966 with the aim of enabling schools, principally in the UK, America and Australia, to offer students the opportunity to study Latin where they might not otherwise be able to do so because of the lack of specialist Classics teachers. At the relevant dates the CSCP web-site was used by approximately 400,000 teachers and students world-wide and had up to 100,000 visitors per hour. It provided free access to the Cambridge Latin Course in digital format in the UK. Access in North America was on a charged basis. In a normal year, this led to revenue of approximately one million pounds from the sale of hard copies of the text book. Further income was derived from the sale of digital support materials. Many schools did not have the physical text books and depended entirely on the web-site and DVDs operated in conjunction with the web-site.

[22]The Claimant was issued with a Statement of Terms and Conditions/Contract of Employment dated 4 October 2011. This stated that he was Director of the CSCP, assigned to the Respondent’s Department of Education; that he should carry out the duties set out in his role description and that “you should also comply with the directions given by your head of institution”. It went on to say “It is recognised that you may frequently work unsupervised. It is essential, therefore, that you and the University work in a spirit of mutual trust and confidence and that in carrying out your work you promote the interests of the university”.

[23]The contract also stated that the University’s disciplinary rules and procedures were available on the University’s web-site. This included at paragraph3.1 a list of examples of alleged serious misconduct which, in addition to “gross negligence, theft or misappropriation of University property“ and ”threatening or using physical violence” also included “unreasonable refusal to carry out an instruction”. Paragraph

3.2 contained a power to suspend and paragraph

3.3 provided that the responsible person investigating any alleged serious misconduct would, if satisfied that he has committed an act of serious misconduct, invite the person concerned to an interview with the Disciplinary Committee to be held whenever possible within 28 days of the serious misconduct allegation.

[24]I turn now to the events which are central to the disciplinary allegations against the Claimant.

[25]These began on 22 June 2016 at 18.03 when the Claimant received an email from Dr J Knapton, the Respondent’s Information Compliance Officer. He introduced himself to the Claimant as the person “responsible for the University’s compliance with the Data Protection Act 1998, including (with others in UIS who are copied in) handling our responses to data breaches”. UIS stands for University Information Service. Information in that sense included Information Technology. The UIS personnel to whom Dr Knapton copied his email were Michelle Finnegan and Kieren Lovell. It is fair to say that none of these individuals had previously been known to the Claimant.

[26]The purpose of Dr Knapton’s email was to inform the Claimant that he had received a report that day that the CSCP web-site had been hacked and that the email addresses and passwords of approximately 1500 external users had been published on the internet. He went on to state that this had been “picked up” by the press. Dr Knapton observed that “the breach is relatively serious” and that his colleagues in UIS had asked that the site be secured as a matter of urgency. It was also necessary to alert all users of the breach and to report what had occurred to the Information Commissioner.

[27]The Claimant spent the rest of the evening communicating with Kieren Lovell and others. At this stage the principal risk to be identified was “password portability” i.e. that some users whose data had been hacked might use the same password for other purposes. He and Mr Lovell agreed a three point plan. He explained to Mr Lovell that to make use of these data on the project’s own web-site an individual would have to obtain and install the DVD software; this would allow them to access and edit playlists of Latin lessons. He considered that while this would be undesirable it was not a serious risk compared to password portability. The three point plan involved the Claimant checking the playlist data; contacting the users advising them to change their passwords if appropriate; and to investigate ways of defending the data in the system in future. On the last point the Claimant commented that their newer systems have much better defence “but this one was launched in 2004/5 and it’s clear that it needs a review”.

[28]At 2pm on the following day Dr Knapton emailed the Claimant to say that his view was that “we really should not have this resource live while the compromised access details are accessible to the world at large (regardless of the fact that the thing they are accessing is so bland)”. The Claimant responded by explaining that the risk was “teeny tiny” and again asserted that the real issue was passport portability. Dr Knapton did not dispute what the Claimant had told him but replied (at 15.16 on 23 June 2016) as follows: “I do see that the risk of any misuse is tiny, but I cannot imagine the Information Commissioner’s Office accepting this argument and I think they will instruct us to take it offline and, at the least, we should be prepared for this. I have copied in Martin, Michelle and Kieren for their information and comment”.

[29]Martin was Martin Bellamy, the Director of Information Services, University of Cambridge, and head of UIS. He emailed the Claimant at 16.13 (effectively one hour after receiving the email) as follows: “In my capacity as Senior Information Risk Officer for the University, I have regrettably made the decision that the compromised website must be taken down immediately and remain offline until the vulnerability is fixed. (This means disconnection of the service from the internet)”. He explained that his decision was based upon the possibility of other hackers accessing the site and illicitly accessing personal information. There was a duty of care to the individual users to protect their interests until site security was restored. He concluded: “Apart from the duty of care to individuals, the external expectation is that we will treat such incidents extremely seriously and act with the utmost haste. External parties would have expected the site to have been taken down by now, and any further delay in taking this action thus adds to reputational risk. I am therefore asking that you implement this decision as a matter of urgency and confirm to me and those copied when this has been done”. Seven individuals were copied into this email, including Michelle Finnegan, Kieren Lovell and James Knapton.

[30]Dr Knapton emailed the Claimant shortly thereafter noting that the decision had now been taken to take the site down and that the email the Claimant was to send to users should be amended accordingly.

[31]The Claimant emailed all concerned at 17.43 on 23 June to say that he was not convinced of the need to take the entire website down, “particularly as it delivers highly important material to large numbers of teachers and learners each day, much of it exam related. So while we may want to look at altering certain sections of the site, total shut-down is neither a viable nor a necessary option at present”. He was not happy to send the email to users in its amended form referring to the site being shut down and asked for further discussion to take place in the morning “when there is time for those involved to get a better understanding of the situation”. He also referred to a comment made earlier by Michelle Finnegan alluding to an issue having been identified on 2 May of which he stated that he was unaware.

[32]Michelle Finnegan replied to the Claimant (in two emails sent at 17.55 and 18.04). In the first she confirmed that she was willing to talk to the Claimant about the vulnerability issue. This was clearly a reference to the issue identified on 2 May as she wrote: “I just tried to talk to you about the vulnerability. I was told you were aware of this but the terms used may be different so it might be easier to talk about it. Can we arrange some time to talk? I am free tomorrow morning ….” She then sent a second email in case the Claimant construed the first as meaning that she was offering a meeting to discuss the decision to shut down the site. In her second email she wrote: “For clarity, my response below refers only to the portion of your email specifically directed at me. It does occur to me that the University SIRO may not be a role you are familiar with so it is worth mentioning that the role is empowered by the Information Service Committee to make decisions such as this to protect the University and the decision should be considered an instruction rather than a request”.

[33]At 19.00 the Claimant’s Line Manager, Professor Hayward, emailed him as follows: “You really must take the website offline as failing to do so will cause the University problems with the ICO. Hopefully the problem can be fixed relatively quickly. I appreciate that this will cause some short term issues but I have to insist that this is done”.

[34]The Claimant replied at 19.13, with copies to all other addressees, including Martin Bellamy, as follows: “Many thanks for your email. I’ve no doubt it’s intended as an instruction, but I’m afraid it’s not one that is going to be implemented, at least until I can be confident that it is the correct course of action”. He went on to say that the department – UIS –was not fully aware of all the issues and, as such, was not in a position to make informed decisions. He again referred to the chaos which would be caused to “100,000s of users and teachers around the world, many of whom are in the final stages of exam preparation”. He continued: “I’m not going to refuse to listen and to take sensible actions but nor am I going to recklessly turn off a website that is depended upon by so many at a key part of the education cycle. As your department has been aware of this issue since 2nd May yet only flagged it with me yesterday, I am not overly convinced that knee-jerk reactions today need to form part of the best solution”.

[35]At 9.23 the next morning Michelle Finnegan offered to come and talk to the Claimant at 11.00 to meet and gain a better understanding of the implications of shutting down the website in full. The evidence regarding that meeting is one of the only areas of actual dispute. It is agreed that Ms Finnegan arrived a few minutes early and was accompanied by two UIS colleagues, Kieren Lovell and Dave Berry. It is also agreed that the Claimant initially stated that he wished to speak to Ms Finnegan alone and her colleagues waited outside. The Claimant relies upon the account of Ms Laila Tims, who was at that time a Project Assistant. She no longer works for the Respondent, having left in June 2017 three months after returning from maternity leave. Since 19 January 2017 she (together with the Claimant and three others, including Tony Smith, also a witness on behalf of the Claimant) has been a director of the Hands Up Education Community Interest Company, seeking to create and share high quality teaching resources in Latin and Greek for teachers. Although not-forprofit, the materials produced by the organization have a similar target consumer, at least in part. It was clear that both Ms Tims and Mr Smith have a high regard for the Claimant and a desire to support him both in his Tribunal claim and in the continuation of his educational activities promoting the teaching of the Classics.

[36]Ms Tims overheard the discussion on 24 June and was talking to a colleague on Skype at the time. She provided her colleague with a commentary which she reproduced as an Appendix to her witness statement. The account begins at 11.02 and includes the following which I accept as an accurate contemporaneous record reproduced from Ms Tims’ Skype account: 11.02.12: Someone is here to see him and she brought two other people along 11.02.33: and he’s not letting the hangers on in! 11.04.58: she’s here to tell him to take down the website 11.08.31: she’s just admitted that shutting down the website doesn’t actually solve the security problems 11.08.56: but they want to do it to “protect the University’s reputation” 11.09.38: Will is arguing that 400,000 students not being able to access the website today will certainly not help the University’s reputation 11.10.48: she tried to say that people could use the DVD and so don’t need the website access 11.10.56: so Will is now showing her the DVD 11.11.24: and he’s really taking his time over explaining the whole DVD 11.17.21: he’s just saying that UIS should have come talked to him in May if they were worried about a security breach then 11.39.06: sounds like the website may need to come down after all 11.39.18: one of the loitering guys has come back up and turned out to be more knowledgeable 11.39.37: and Will is I think now convinced that there is good reason to take it down 11.40.28 (other party): Oh right, for how long? 11.40.41: not sure, tech guy is now going to show Will what can be done 11.57.20: I think it’s up in the air again what’ll happen now 11.59.09: Michelle is totally on Will’s side now as well, hilariously 12.23.41: they’re just about to leave 12.23.51: and are apologetic to Will, amazing!

[37]Ms Tims in her witness statement explains that Kieren Lovell was only present for a brief period and then had to leave. The period from 11.40 to 11.57 was taken up with examining the site, including Kieren Lovell’s concern that one item he had found on the site might have been inserted by a hacker. This had turned out to be an ancient wax tablet and the Claimant had shown that it was a bona fide part of the site and not in any way suspicious; although Kieren Lovell had left the meeting before this was done.

[38]The Claimant’s recollection of the meeting is similar to that of Ms Tims.

[39]Ms Finnegan’s account at page 303-4 of the Hearing Bundle differs only in respect of the most important issue, namely the conclusion. She states that the meeting did not make any difference to the decision that had already been taken and that she could not change that decision as she had sought to make clear in her second email at 18.04 on 23 June; the ideal scenario would be to take the site down in a controlled fashion now, fix it and bring it back up once confirmed it was fixed. She goes on to state “Will confirmed he understood that”. Ms Finnegan’s account is unsigned and undated. It appears to have been produced for the disciplinary investigation/hearing. She has not given evidence to the Tribunal.

[40]At 13.41 the Claimant emailed Tony Smith, a freelance contractor engaged by the Project, asking him to remove various databases from the site. He did not ask him at this stage to shut the site down.

[41]It is material to note that although all relevant addressees were aware from Michelle Finnegan’s email of 9.23 on 24 June that she and the Claimant were to meet at 11.00 to gain a better understanding of the implications of shutting down the website in full, at 10.55 (five minutes before that meeting was due to start) the Claimant was sent another email. I accept that he did not read it until after his meeting with Michelle Finnegan and her colleagues. The email was from Emma Rampton, Academic Secretary and Deputy Registrar who had been a recipient of all the emails between Ms Finnegan and the Claimant. Her email read as follows: “I am writing on the instruction of the Vice-Chancellor and further to yesterday’s email to you from the University’s Senior Information Risk Officer to require you to take down the compromised website immediately and to keep the website offline until further notice from UIS. This means disconnection of the service from the internet. Given the risks associated with the website remaining live, the University is taking this issue extremely seriously. Please confirm by return that the instruction has been fully enacted”.

[42]The Claimant accepts that the Vice-Chancellor is the most senior officer of the University. He states, however, that he believed, following the conclusion of the meeting with Michelle Finnegan which had taken place after the email on behalf of the Vice-Chancellor, that that instruction no longer applied, or at least was “on hold”.

[43]I note from an email from Emma Rampton at 12.30 that there had been a meeting of the University’s Silver Team (a multi-disciplinary group which met to discuss and take action on security risks) earlier on 24 June at which one of the decisions taken was that the Vice-Chancellor would instruct the Claimant to take down the website immediately and in full.

[44]Ms Finnegan subsequently told Mr Dampier, the investigating officer, that she had attended that meeting as Martin Bellamy’s deputy and that the meeting had asked her to continue to meet the Claimant and confirm that the website had been taken down. All witnesses confirm that this is how the 11.00 meeting began, with Ms Finnegan insisting that this be done.

[45]There is clearly, however, a disagreement as to how the meeting ended. The Claimant, supported by Ms Tims, states that Ms Finnegan had apologised to him and, in effect, agreed to reconsider the instruction. I accept that this was the Claimant’s genuine understanding of how matters had been left as at the end of the meeting. However, shortly after the meeting he read the instruction communicated to him by Emma Rampton on behalf of the University’s ViceChancellor, albeit that this was sent before the meeting with Ms Finnegan took place. I accept that the true situation was unclear to the Claimant between the end of his meeting with Ms Finnegan and 14.49 when Ms Rampton again emailed the Claimant, as follows: “I have had no reply to my email to you of earlier today. However , I understand from Michelle Finnegan of UIS that your position remains unchanged and that you are refusing to take down the web-site as instructed”. She went on to ask him to attend a meeting in the Vice-Chancellor’s office at 4pm at which he was entitled to be accompanied. The Claimant agreed at the Tribunal that he appreciated that this appeared to be a preliminary to potential disciplinary action.

[46]He replied at 15.09 saying that he had just returned from “the school run” so would not be able to attend the meeting at 4pm but could “patch in” by phone if that would be useful. He went on to state that the meeting with Miss Finnegan had not ended with him saying that he would not take the web-site down but that he had discussed “options and timings for doing so”.

[47]The meeting did not take place in the Claimant’s absence but at 16.26 the ViceChancellor emailed the Claimant personally as follows: “You have now been asked on at least four occasions to shut down the web-site with immediate effect. I repeat this instruction one last time. Please confirm to me that you have now complied. The meeting will be rescheduled for early next week”.

[48]At 16.30 the Claimant’s Line Manager, Professor Hayward, emailed asking him to “please do as requested” and offering IT support if needed.

[49]At 16.35 the Claimant sent a lengthy email to Ms Rampton with a copy to the Vice-Chancellor explaining his understanding of the discussion that morning with Michelle Finnegan and her UIS colleagues and stating that he was awaiting a response “on next steps”. He stated that in the meantime he had acted swiftly to remove from the site all user data and that “we have in place options for controlled take-down”. He also explained the volume of usage per hour and per day and why he considered it desirable to limit the time the site was down to15- 30 minutes. He considered that after removal of all user data from the server there was no longer a security risk. He did not comment on the other risk identified by senior management namely the expectations of the Information Commissioner.

[50]The Claimant emailed the Vice-Chancellor at 16.38 suggesting that they shut down the web-site either later that night or the following morning. He asked how long it would be off-line and said that he had understood from his discussion with Ms Finnegan that “30 minutes off-line would probably be sufficient”. He asked if this was correct.

[51]At 16.46 the Claimant sent a further email to the Vice-Chancellor, expressed as a post-script, in which he mentioned for the first time that he was off to the US first thing tomorrow for a week to promote the University and its outreach work. He added that he had been doing this for 16 years and had never been given the thanks he believed he deserved. He did not, however, explain in detail the purpose of his visit or raise any difficulty about the web-site being off line while he was there.

[52]The Vice-Chancellor replied at 16.51 as follows: “You are instructed to take the web-site down now. It will remain off-line until UIS is satisfied that it can be safely restored. Please comply immediately”.

[53]There was a brief exchange regarding how UIS would test the web-site off-line. The Claimant’s Line Manager, Professor Hayward, emailed at 17.33 stating: “Will, I am sure that can be managed. Please do what you are being asked to do and confirm when it has been done ….”

[54]At 17.40 the Claimant informed the Vice-Chancellor that the site was off-line. He told the Tribunal that he then expected UIS to take whatever action they wished as a matter of urgency so that the site would swiftly be up again. He complained to Ms Finnegan in a series of emails that evening that UIS had not been active. Ms Finnegan confirmed that she had taken screen-shots of the web-site off-line to provide to the Information Commissioner and that UIS would test it. The Claimant argued that all data was off-line and that SQL log-in points and databases had been removed “ready for testing”.

[55]The Claimant was about to go to the United States for a large conference at which he hoped to present and promote the CSCP to a very significant number of potential subscribers. He did not explain this to the Respondent but instead contacted Mr Smith at 11am on 25 June and asked him to bring the web-site up again, which he did. He did not contact UIS or his Line Manager or the ViceChancellor before doing so; nor did he inform them that the site was now live again.

[56]At 17.48 on 25 June Emma Rampton again emailed the Claimant stating: “It has just been brought to my attention that the site Cambridgescp.com has been reactivated and is on-line. You are required to take down the Cambridgescp.com immediately. As you were previously instructed, the site must remain off-line until further notice from UIS.”

[57]The Claimant responded with a full explanation of why he had acted as he did: the failure of UIS to begin work after the site was taken off-line the previous evening; and what he believed to be the very serious financial and reputational damage to the university of taking the site off-line suddenly and for any length of time without a plan of action. He commented: “You think the data release was caused from an external access. I would just suggest to you that you are not yet in a position where you can be expected to be aware of all the issues”. He went on to refer to the meeting the previous day where a suspected hack turned out to be a bona fide link to a 1st century AD Roman wax tablet. He commented further: “I am not saying it is not possible to hack our site – with enough effort and skill any web-site can be hacked. But I am saying that we need to act rationally and carefully”. He concluded by saying that he was currently in the US and in a different time zone.

[58]The Claimant did not, however, agree to take the web-site down as instructed.

[59]At 20.21 on Sunday 26 June (UK time) the Respondent’s Joint Head of Legal Services, Ms J Cheffins, emailed the Claimant. She stated that she had been consulted over the weekend by senior officers of the University regarding “the significant legal and reputational risk associated with the continued accessibility of the web-site”. She continued as follows: “I understand that the site is still accessible despite several written instructions to you to ensure the site is taken down and remains off-line until vulnerabilities are fully assessed and fixed. I also understand that we now have evidence that the compromised data has been manipulated and users’ data are being abused. This is an extremely dangerous situation and your failure to comply with those reasonable and necessary instructions poses substantial legal and reputational risk for the University”. She went on to state that the web-site must be taken down and remain off-line until further instruction from Dr Bellamy, the Head of UIS; and that he would be hearing from the University’s external solicitors, Brown Rudnick.

[60]The Claimant’s response was as follows: “Thanks for your email. If we take the site off-line, will the University pay all costs associated with that action and take responsibility for all its consequences?”

[61]Ms Cheffins replied: “You do not seem to understand the seriousness of the situation. It is a criminal offence recklessly to disclose personal data (s.55 Data Protection Act). You are putting the University in a position where it is potentially criminally liable because it is allowing a site to remain live when it knows it is not secure”. She again asked him to take the site down immediately and to confirm that it would not be restored without further instruction.

[62]The Claimant replied stating that he was “fully aware of the seriousness of the situation” and would take the site down in the morning although he did not agree that it was necessary to do so as personal data had been removed from the server. He also stated that “in 18 years our server has been compromised just twice. We must always be looking to improve security but that’s a pretty solid record and hardly a sign of recklessness”. Indeed, he again argued that the reputational and financial damage to the University if the site were taken offline would be greater and, for the first time, mentioned the impact on his ability to demonstrate the software at “the world’s biggest Latin conference” with the loss of “sale after sale in its biggest market”.

[63]In parallel, Professor Hayward was seeking to speak to the Claimant, asking him when he was due to return from the US and asking him for his mobile number and a time when he could call him as it was “very urgent”.

[64]At 7.48 on Monday 27 June (UK time) Mr Lovell notified all concerned that the web-site had again been taken down and that the home page simply announced that this was “at the request of the University of Cambridge”.

[65]At 17.46 that day Brown Rudnick emailed a letter to the Claimant which set out the University’s concern which was stated to be that the Claimant had failed to comply with clear instructions that the site be taken down and not restored without authority via UIS. The letter stated that the purpose of the instruction was “so that security vulnerabilities could be assessed and fixed before the site was returned to service”. The letter acknowledged that the site was again offline but the Claimant had not confirmed that it would remain so and his communications were “intent on providing justification for the site to be made available”.

[66]The solicitors’ letter set out five undertakings which the Claimant was required to give by 11am CDT. In practice, this gave the Claimant approximately one hour to do so. In fact, he compiled with the first four which were as follows: 1. To return to the UK immediately on a flight booked for him. The purpose was stated to be to attend an emergency meeting at 9.30am on 29 June 2016 but in the event this does not seem to have taken place; 2. Not to restore the site without prior written approval; 3. Not to delete the site or in any way deal with it without prior written approval; and 4. Not to communicate with the ISP of the site without prior written approval. There were four other requirements which do not need to be listed here.

[67]The fifth undertaking, which the Claimant felt unable to give, was worded as follows: “not to communicate without prior written approval from us with any other third person or body in regard to the site and/or the Breach (including current and potential users of the Site and the media).”

[68]The Claimant responded immediately undertaking to keep the web-site off-line but said he would need time to consider the other undertakings. As indicated above, the only one which he declined to give was not to communicate with third parties. He stated that he was surrounded by 300 potential users of the site and that it was “ridiculous” to suggest that he could not communicate with them. He went on to “reserve my right to free speech”. The Claimant has subsequently pointed out that his wife was a user of the web-site and that this indicates that the undertaking was unreasonably wide and unreasonable. With regard to the reason given at the time, Messrs Brown Rudnick replied that as he was required to return to the UK immediately there was no need or indeed scope for him to communicate with the persons attending the conference.

[69]On 28 June Professor Hayward wrote to the Claimant informing him that there was to be a disciplinary investigation into his conduct and that he was required to attend a meeting on 30 June. He was suspended on his return to Cambridge and informed by letter dated 30 June 2016 that three disciplinary allegations of serious misconduct were to be investigated: 1. Unreasonably refused to comply with requests from senior management, including the Vice-Chancellor, to take down the above web-site and subsequently reinstated the above web-site contrary to the request from the Vice-Chancellor; 2. Unreasonably failed to confirm in a timely manner that you would comply with the Undertakings set out in the attached letter, which are necessary to ensure that the University’s position in relation to the web-site, and in particular its obligations under the Data Protection Act, are effectively protected; and 3. Unreasonably failed to confirm that you would comply with the Undertaking “not to communicate without prior written approval from us with any other person or body in regard to the Site and/or the breach (including current and potential users of the Site and the media”. The above wording and punctuation are reproduced from the letter dated 30 June. The Claimant was also informed that other disciplinary allegations might be added if they came to light during the investigation.

[70]Mr Dampier, who was at the time employed by the Respondent as a Director of Business Effectiveness and also as Director-Digital Initiatives and Strategy. In the latter role he was responsible for implementing a complex programme to replace library management systems for one hundred university and college libraries and developing a strategy for innovative digital library services. He was asked by the Director of Human Resources, Emma Stone, to carry out the disciplinary investigation. He had experience of two previous investigations at the University. He had no prior knowledge of the Claimant or the CSCP but his background and responsibilities made it likely that he would be able to understand and assess the subject matter.

[71]Mr Dampier carried out his investigation during July and August although for part of this time he was on his summer holiday. He read the relevant communications and interviewed nine people including the Claimant; Dr Knapton; Michelle Finnegan; Kieren Lovell; Emma Rampton; and Professor Hayward. He also investigated the use of a company credit card by the Claimant for a particular purchase which the Claimant was able to explain to his satisfaction. At the Tribunal hearing the Claimant criticised Mr Dampier for including this subject matter in his investigation report. It is certainly arguable that as this allegation had not been raised initially there was no need to include it, but I accept Mr Dampier’s explanation that he had been asked to add this to his investigation and it was, therefore, appropriate to report back on his findings which, as it transpired, fully exonerated the Claimant. I am satisfied that there was no adverse motive on Mr Dampier’s part in including this subject matter in his report; nor on the Respondent’s part in adding it to the investigation. On the face of it there was a legitimate matter to investigate.

[72]Mr Dampier’s interview with the Claimant took place on 13 July 2016. The Claimant was advised that he had the right to be accompanied by a trade union official or a work colleague but attended alone. Mr Dampier was accompanied by Ms Stone. The meeting lasted two hours and Ms Stone’s notes comprise eleven typed pages.

[73]They discussed a reported vulnerability on 2 May 2016 but the Claimant stated that he had only been notified of this by Simon Buck, an IT technician employed by the University, who had been concerned that the project’s web-site was vulnerable but there was no evidence at that time that it had been hacked. Mr Buck had suggested taking the web-site down or changing its branding but the Claimant had resisted this and nothing further was said about it. I accept the Claimant’s evidence on this latter point, which is supported by Ms Tims.

[74]Mr Dampier then took the Claimant through recent events, beginning with Martin Bellamy’s request to close the site following the report of hacking on 22 June. The Claimant told Mr Dampier that his concern was the effect on the large volume of users of the site and that he had not been saying that he would not take down the site but wanted to discuss the pros and cons and make sure everyone had all the information available.

[75]He referred to the meeting with Michelle Finnegan as having ended well and that he had advised that he would take the site down and had already spoken to Tony Smith about removing all user data as he was concerned that “just taking off-line wouldn’t protect data in files on the server and the risk was not solved by simply turning off”. He described deleting the user data as “a good first step regardless”. Ms Finnegan had, however, told him at the start of their meeting that the web-site was coming down “by hook or by crook”. He believed Ms Finnegan had changed her mind by the end of the meeting. Mr Dampier told him that Ms Finnegan had stated that she had made it explicit at the end of the meeting that the site still had to be taken down despite the Claimant having told her of the adverse consequences.. The Claimant stated that this was “a difference of opinion”. He had been surprised to receive an email from Emma Rampton stating that Ms Finnegan had told her he was still refusing to take down the site as this was not the case. He agreed, however, that he did not do so until he had been instructed by several people: Dr Bellamy, the Head of UIS; Professor Hayward, his Line Manager; and, ultimately, the Vice-Chancellor.

[76]Mr Dampier then asked the Claimant why he had put the site back on line. He said that he had been concerned that the site had been off-line for 17 hours and that no work was being done by UIS to test or repair it, if necessary. He was about to attend a conference in Texas where he would be seeking to sell the project to delegates with accumulated spending power of 3 million dollars. At 11am on 25 June he told Tony Smith to put the site back up again on the basis that he hadn’t heard anything and couldn’t identify a threat. He asked Tony Smith to watch the site and “if something did happen they could take it down again”. He said that he expected to receive an angry email from Emma Rampton upon arriving in Austin, Texas.

[77]With regard to the second disciplinary allegation (delay in responding to the letter from external solicitors) he considered that he had responded in a timely manner given that he was tired and hungry having only just arrived after a long flight.

[78]With regard to the third allegation, that he failed to give an undertaking not to communicate with third parties regarding the site, he said that he was unclear what he was supposed to do. Did he really need to ask the lawyers’ permission to speak to his wife who was a teacher and potential user of the web-site? He told Mr Dampier that he “understood the lawyers would be concerned he would start spreading things but he knew well that he wouldn’t and, therefore, didn’t think it a priority to communicate that to them ….”

[79]Towards the end of the meeting, Mr Dampier informed the Claimant that “UIS had brought a team in to try and wrap a firewall around the site to protect from further penetration”.

[80]During the meeting, the Claimant had mentioned that Tony Smith had been the person who was most active in delivering the site (and also removing data user information and, at the Claimant’s instruction, closing the site down and bringing it up again). He asked Mr Dampier to speak to Mr Smith and Mr Dampier said he would consider whether it would be “appropriate and beneficial”.

[81]In the event, Mr Dampier did not speak to Mr Smith. He took the view that he did not have relevant evidence to give with regard to the disciplinary allegations. Also, Mr Smith was an independent contractor, not an employee, and Mr Dampier was advised by HR that external persons would not generally be interviewed unless they had material evidence to give.

[82]At the end of his investigations, Mr Dampier produced a report which he submitted to Professor Hayward on 11 August 2016. In his report he gives a comprehensive account of the background to the events of 22-27 June 2016 and the many communications involving the Claimant. In paragraph 22 of his report he concludes that he finds the three allegations to be proven. Mr Dampier accepted at the Tribunal hearing that this was not his function – he had been tasked with investigating to ascertain whether there was a disciplinary case to answer, in which event Professor Hayward, to whom the report was submitted as the Claimant’s Line Manager, was responsible for referring the matter to be dealt with formally by way of a disciplinary hearing.

[83]Mr Dampier also went further than his brief in including a section headed, “Mitigation” in which he commented that he had no doubt that the prominence of the Major Classics conference was a significant factor behind the Claimant’s actions; and that he had removed sensitive data and was concerned that there was a delay in dealing with the site which was prolonging the length of time it was down. Mr Dampier concluded that this was why he took the decision “to reactivate the site in what he considered to be a safe state”.

[84]At the end of his report, Mr Dampier stated that during his interviews with members of staff, four individuals had independently raised concerns about the Claimant’s behaviour, suggesting that he “becomes aggressive, with a tendency towards bullying behaviour, towards other members of staff when he is challenged on his ways of working, or there are areas of discussion he disagrees with”. He commented that the University had a duty of care towards its staff and that having heard repeatedly during this investigation that there was an issue with the Claimant’s behaviour, this should be addressed.

[85]Professor Hayward referred the matter to HR who in turn arranged for a disciplinary hearing to take place on 8 September 2016. A panel was appointed in accordance with the Respondent’s disciplinary procedure It was to be chaired by Professor Richard Fentiman, Head of the University’s Faculty of Law. The other two members of the panel were Simon Moore, Professor of Computer Engineering; and Fiona Duncan, a Department Administrator. Professor Fentiman wrote to the Claimant on 25 August enclosing a copy of Mr Dampier’s report and its substantial appendices, including the interview notes. He informed the Claimant of his right to be accompanied and also that “if there are any witnesses who you believe could provide relevant information to the allegations and you would like to be present then please provide their names for consideration”. He was also told that if he wished to call any witnesses he should let HR know by the end of the day on 5 September. In the meantime, he remained suspended on full pay.

[86]At the Tribunal hearing Professor Fentiman was asked about the fact that Mr Dampier had reported that he found the allegation proven. Professor Fentiman stated that he understood that the investigation report should have limited itself to a finding of whether there was a case to answer in respect of the allegations and that he and his fellow panel members were aware that it was their responsibility, not that of Mr Dampier, to decide whether the allegations were proven. They were not influenced by the inappropriate wording used by Mr Dampier. I accept that this was the case.

[87]The Claimant stated near the beginning of the disciplinary meeting that he had heard from colleagues that it was unlikely he would be returning to work. The panel sought to assure the Claimant that no decision had been taken and none would be taken until all parties had been heard and all the facts considered after the meeting had ended.

[88]Professor Hayward then presented the management case, beginning by explaining that the CSCP had been in existence for 50 years which he described as an outstanding achievement and that the Claimant had made an outstanding contribution since he joined. The Panel asked Professor Hayward to give his assessment of the risk of reputational damage to the University “of the site being left up versus being taken down”. He replied that he agreed with the Claimant’s account of the consequences of the web-site coming down. It involved cutting off a resource used by thousands of teachers across the world and the potential knock-on effects in terms of the commercial risk for the fourth and fifth edition books. This was set against a considerable reputational risk which, at that time, included the possibility of children being directed to inappropriate sites and knowingly being in breach of the Data Protection Act which left the University liable for substantial fines. Professor Hayward’s view was that that risk to the University trumped the risk to the CSCP of the site being taken down. He said that the matter had “left him with a feeling of absolute sorrow and nothing but sadness as this didn’t need to happen. However, he felt that the action taken had been appropriate on the basis of the risks.

[89]The next person to address the panel was Mr Dampier. He answered a number of questions from the Claimant and the panel. The Claimant then “confirmed that he thought the report was a fair account”.

[90]The Claimant then presented his response. He explained that the project had been run independently of the university administration and he had had no previous involvement with the senior officers who contacted him following 22 June. They were not familiar with how the project and its web-site operated or the risks to the University of taking the site down as well as the risks of keeping it up. He nevertheless “completely accepted what he was told by senior management to do and he didn’t comply; he knew they had said “take the website down and that UIS were to check before it was put back up, he knew that and he did put it back up”. The Panel asked him why he had done so and he replied that UIS had taken no action after the site was taken down. Subscribers of the site who paid to access it were given a contractual commitment that it would not be down for more than 44 hours. By the time he brought it back up it had been down for 17 hours and no-one was taking any action. There was no personal data on the server as he had had it removed; so there was no risk to people, only to him. He thought the Information Commissioner’s Office could not get upset if no citizens lost out. He was worried that if no work was done on the site over the weekend they would have been down for more than 44 hours. He therefore took the decision to put the site back on line – “no-one had told him he could but he thought it was the right decision at the time”. He explained the loss of income from the conference in Texas: “going off-line during that conference was not helpful …. He stated that it was not in his personal interest to take down the site but it was in the University’s to leave it up”.

[91]The Claimant went on to comment about what he considered to be an unreasonable requirement by the external solicitors requiring him to respond within an hour and to undertake not to speak to anyone about the site being down which, as he was surrounded by hundreds of potential users, was not realistic.

[92]He also commented on the concerns expressed by other University staff about his behaviour. He stated that “he didn’t think he was a bully although he recognised that sometimes he would “have to push back”.

[93]There was then a discussion regarding the extent of any risk to the University of leaving the web-site up once the personal data had been removed. The Claimant stated that he couldn’t see the risk as a site could always be hacked as no site was 100% secure and they were monitoring for incursions. Professor Hayward at this point advised the Claimant that the advice from the Senior Information Risk Officer who had been through 10% of the code for the project was that a technical investigation had found 1840 vulnerabilities, leading to the recommendation to shut down the site while further investigations took place. The Claimant replied that the site had been on-line for 12 years with only 2 accesses and that “vulnerabilities could be found in anything”.

[94]Professor Fentiman brought the meeting to a close with a summary of the opposing views. The Claimant agreed that this was a fair summary, noting that there were risks on both sides but that in his view the greater risk was in taking the site down.

[95]The meeting lasted 2 hours and 50 minutes. The Claimant was informed that he would receive a written decision in due course.

[96]In the event, the panel met again on 14 September 2016 without inviting the Claimant. They did so in order to interview Kieren Lovell, a member of UIS (the University Information Services) who had corresponded with the Claimant immediately after the reported hacking of the web-site and who had also briefly attended the meeting with Michelle Finnegan and another colleague Dave Berry. The panel asked him for further information regarding the web-site and the extent to which there was, in his view, a continuing risk. He told the panel that personal identifiable data had been removed as the Claimant had stated but that “the actual playlist still had activations”. He went on to state that “this meant that it hadn’t been done completely”. The way the web-site was set up meant that people were clicking links in DVDs which were still working and could still be altered. He told the panel that when UIS looked at the code base they found poor coding practice, three payments systems which were still active within the code base and passwords embedded within the code in plain text which could have been extracted. He agreed that the Claimant had “made best endeavours to remove the personal data but that this was a quick fix and not in depth enough”. He went on to say that there were a number of IP addresses in the code which gave elevated rights and that one was located in the red light district in Amsterdam. Mr Lovell referred to a link to a site by the name of eHarmony which the Claimant had explained was legitimate and a genuine part of the project web-site. It told Mr Lovell that “this was no longer a problem”.

[97]Mr Lovell was then asked about the Claimant’s expectation that once the website was down the emergency response team would act very quickly to repair it. Mr Lovell replied that “a proper development team” was needed to fix the site and, in effect, this could not be achieved within the timescale the Claimant had hoped for.

[98]After Mr Lovell left the panel discussed the information he had given them and sought further clarification. Ultimately, they produced an agreed note of what they understood to be the evidence on these issues following the interview with Mr Lovell. This led to the following questions and responses from Mr Lovell on behalf of UIS: 1. That the SQL injection attack was not reproduced so the attack method was based on information provided by hackers. The cause of the attack was, therefore, based upon a hypothesis. Mr Lovell confirmed that this was correct but that the hypothesis was subsequently confirmed as correct. 2. That there was no evidence that the web-site had been modified by hackers. Mr Lovell replied that at the time he was concerned at a huge spike in eHarmony traffic but understood that this had now been explained by the Claimant. 3. That all personal data had been removed from the site before it was put back up, thereby mitigating further personal data loss. There was, therefore, no further risk of personal data loss when the site went back up. Mr Lovell’s reply was that they had been unable to ascertain at the time whether all personal data had been removed; but that once it was down, they had found open SQL databases containing names, email addresses and addresses of schools of associate teachers in the UK and the US on a server that had “a number of large security flaws. Due to these flaws, the external contractor suggested that the project was not worth fixing and that restarting the project from scratch would be safer”.

[99]On the same day, the panel made a phone call to Professor Hayward to ask him “how he may view some of the possible outcomes”. He told the panel that he had contingency plans in place. He went on to say that he no longer had trust in the Claimant, and that key people at Cambridge University Press (CUP) had said that they were unwilling to engage further with him. He went on to suggest that the Claimant “could take on an outreach role” and that a project manager could be brought in to manage the day to day issues until he had regained Faculty trust. Professor Hayward also said that he would like the Claimant to attend a behaviour management course if he were to return. He needed to stop considering the project as an independent unit as it was part of the Faculty of Education and the University of Cambridge. If he were not to return there would be a “short and medium hit” to the reputation for Latin and sales in the Cambridge Latin course. The Faculty had begun to carry out a review of the CSCP before the hacking incident. It was a viable project but not well-managed. He had respect for the Claimant and had still been trying to protect him until he put the site back up against explicit instructions from the Vice-Chancellor. In Professor Hayward’s view this had shown “extraordinary poor judgement” and that he had “willfully put the University at risk”. In response to a further question Professor Hayward confirmed that the Claimant had no previous disciplinary record.

[100]The Claimant was invited to a resumed disciplinary hearing on 16 September 2016. At the start of the meeting he was given a copy of the notes of the meeting with Kieren Lovell and the meeting was adjourned to give him the opportunity to read them.

[101]There then followed a comprehensive discussion of the statements made to the panel by Mr Lovell. It is fair to say that the Claimant did not agree with most of what Mr Lovell had said. He consistently stated that UIS had not fully understood how the web-site worked and how the DVDs were used to make playlists. As a result he considered that UIS overestimated the risk of the website remaining operational while they underestimated (or simply were unaware of) the risks to the University of taking the site off-line. He stated that he understood Professor Hayward’s question about why he didn’t do what he was told but said that all those above were working from information from UIS that was not completely accurate.

[102]He was asked whether he would act differently in the future and responded that he was not concerned with what happened to him – which, in substance, was understood to mean that he believed he had acted reasonably and would act in the same way again if the same situation were to arise.

[103]Towards the end of the meeting Professor Fentiman in effect asked the Claimant the same question he had asked Profession Hayward, i.e. how he would regard returning to his post. He said that he would be happy to return but that there would be difficulties. A lot needed doing and the team was falling apart; but “if there was any hope of him getting his job back, that would be great”. He was not told about the telephone conversation with Professor Hayward.

[104]Professor Fentiman then asked the Claimant whether there were any specific events he would have changed over the relevant 48 hour period. He replied that he would not; he felt that if he had taken the web-site down as instructed on the Thursday night the project would still have ended up with Cambridge University Press “but probably the difference was that he wouldn’t have been fired”.

[105]In the final paragraph of the meeting minutes Professor Fentiman stated that on hearing the Claimant again today it was very clear that he had not altered his position, but had given further evidence of the difference of perception between him and Kieren Lovell/UIS. The Claimant commented that the panel had been very fair.

[106]The meeting lasted just under an hour and a quarter including the time taken by the Claimant to read Mr Lovell’s further interview notes.

[107]Professor Fentiman wrote to the Claimant on behalf of himself and his two colleagues on 22 September. They upheld all three disciplinary charges and the Claimant was summarily dismissed for gross misconduct. They concluded that the Claimant had been given clear instructions and that those instructions had been reasonably given in circumstances where there was perceived to be a high legal and reputational risk to the University. The letter acknowledged that the Claimant felt he had acted in good faith and in the interests of the University; and that as Director of the project he had been used to making independent decisions. However, they concluded that his response, in knowingly not complying with repeated instructions, including by increasingly senior staff up to Vice-Chancellor, had been unreasonable.

[108]With regard to the second and third disciplinary allegations, the letter stated that the further instructions from the internal and external lawyers would not have been necessary if the Claimant had not reinstated the web-site contrary to instructions; and that the Claimant did not deny that he had acted in contravention of those instructions in reinstating the web-site.

[109]Having found that the allegations of serious misconduct were upheld, the letter went on to consider what level of disciplinary sanction was appropriate. It described the Claimant’s misconduct as a wilful and repeated refusal to comply with reasonable, essential and urgent requests made by senior members of the University. It was noted that the Claimant still felt he had done the right thing and, in retrospect, would not have acted differently.

[110]Professor Fentiman went on to state that he and his colleagues had also taken into account the Claimant’s significant length of service; his clean disciplinary record; that he had not acted for personal gain but according to his own assessment of the situation; that he was under particular pressures at the time; and that he did, eventually, carry out the instructions issued. The letter also referred to a breakdown in confidence on the part of the Claimant’s manager and senior management which, it was concluded, could not be restored. If the University could not be confident that he would observe clear instructions in future and instead act upon his own assessment, it was not clear how employment could continue.

[111]In oral evidence at the Tribunal, Professor Fentiman confirmed that at the time they spoke to Professor Hayward by telephone they had not yet made a finding as to the Claimant’s conduct. He stated in cross-examination that the panel were scrupulous in restricting themselves to the facts related to the disciplinary charges when considering whether the Claimant was guilty of serious misconduct. Professor Hayward’s telephone comments – which Professor Fentiman accepted were very different from the comments made in a management statement provided by him on 6 September – had only influenced the panel when it came to consider the issue of trust and confidence.

[112]With regard to the separate meeting with Mr Lovell, Professor Fentiman’s view in cross-examination was that it had not advanced matters or added to what the panel already understood. They had called for the meeting because they wanted to understand better the nature of the differences between UIS and the Claimant. The panel accepted – as had Mr Dampier – that some of the concerns expressed had been shown to be groundless by the Claimant. This included the references to the wax tablet and the eHarmony site. However, Professor Fentiman and his colleagues noted the view of the University’s senior management, based on advice from Dr Knapton and UIS, that there were very serious legal and reputational risks if the site was not taken down immediately. This was partly to satisfy the Information Commissioner’s Office. It was also to ensure that no further breaches could occur – even if that risk was considered small.

[113]The panel appreciated that there was a genuine difference of view between the Claimant and the technical experts relied upon by the University. However, the panel’s conclusion was that “the heart of the case”, as Professor Fentiman put it in cross-examination, was whether the University was reasonable in issuing the instruction and whether the Claimant was reasonable in failing to comply.

[114]The Claimant appealed against his dismissal and his appeal was heard by a panel chaired by Professor Andy Parker. It was heard on 25 November. The Claimant, as before, chose not to be accompanied and did not bring any witnesses. The appeal committee proceeded by way of review, not rehearing. In addition to the papers which had been produced for the disciplinary hearing they had an appeal letter and documents tabled by the Claimant and a statement from Professor Fentiman explaining how and on what basis he and his colleagues had reached the decision to dismiss.

[115]At the appeal hearing the Claimant concentrated on whether UIS had been correct in the advice it had given to senior management, asserting that UIS had not only been wrong in its advice that the site had to be taken down because it was unsafe; but that individuals in UIS, including Mr Lovell, may have deliberately lied. The Claimant has continued to assert this in his claim to this Tribunal and he is supported in this by Mr Smith. He claims that the site was, within a fortnight, moved from the CSCP server to a Cambridge University Press server without altering the code and that “the same activities on the server that UIS said was hacked have been taken and put on the CUP server and been distributed”. It is not disputed that before the incident reported on 22 June a transfer to CUP was being considered.

[116]The Claimant went on at the appeal hearing (and at the Tribunal hearing) to suggest that the hack had been perpetrated internally rather than externally and referred to an individual whom he had asked not to work on the site any more as he was too slow. This was a reference to Simon Buck although his name is not specified in the appeal minutes.

[117]The Claimant also complained that Mr Dampier had decided not to interview Mr Smith as part of his investigation.

[118]Professor Parker asked the Claimant whether there was anything else he wished to say in support of his appeal. He responded as follows: 1. That he had held his salary down for 8 years as Director of the project and had donated to the University an award he had received for his work in Classics; 2. That he knew that the Vice-Chancellor’s instruction was based on information “from people not being honest”; 3. That during the events in question he knew he was putting himself in harm’s way but that it was clear to him that this was in the University’s interest. He “was aware that he would get in trouble” but thought that when people understood his reasons “it would be ok”. He again referred to the impact on users of the site and the loss of potential revenue for CUP if he was unable to sell the project at the conference in Texas. He believed he was trying to avert a disaster for the University.

[119]Professor Parker then invited Professor Fentiman to respond. The disciplinary panel had first come to a decision that there was apparent serious misconduct i.e. refusing unreasonably to comply with explicit instructions that were unambiguous, reasonable and clear. He recognised that the Claimant’s assessment of risk was different from the University’s. The disciplinary panel had then proceeded to consider sanction. Professor Fentiman stated that this was arrived at “partly in light of the serious misconduct”. He went on to explain that the Claimant had expressed no regret and had told the disciplinary panel that he would act in the same way again. The trust in the employment relationship had been “irreplaceably lost” and this was not only based upon the conversation with Professor Hayward (“the opinion of the Head of Department is important but not decisive on the ability of an individual to continue in employment”). Professor Fentiman referred to the fact that where serious risks are stated but ignored it was difficult for the employment relationship to continue.

[120]Professor Parker wrote to the Claimant on 20 December 2016 to inform him that his appeal was unsuccessful.

[121]The appeal panel considered four grounds of appeal. The first was the Claimant’s criticisms of the procedure. With regard to the decision not to interview Mr Smith, Professor Parker noted that the disciplinary investigation was not into whether the server was safe or not; that Mr Smith had not been a direct witness to the sequence of events/emails/communications between the Claimant and others over the concentrated period in question; and that, in any event, the Claimant could have asked Mr Smith to be a witness himself at the disciplinary hearing but had declined to do so.

[122]The Claimant had also complained of the fact that the disciplinary panel had interviewed Mr Lovell in his absence and had not given him an opportunity to question Mr Lovell directly. He had also not been sent the note of the interview with Mr Lovell prior to the reconvened disciplinary hearing. Professor Parker stated in the appeal decision letter that whilst this was true, he had been given a copy of the full interview record at the start of the meeting and given the opportunity to review it. The appeal panel had asked the Claimant if he had any further comments he wished to make about the interview with Mr Lovell but he said he had nothing to add to what he had said to the disciplinary panel and the appeal panel on these issues.

[123]With regard to the second ground of appeal, namely that the technical advice given by UIS had been inaccurate and deliberately misleading, Professor Parker noted, in the appeal decision letter, that while the disciplinary panel had been aware that there were differences between the Claimant’s and the UIS’s technical views as to the safety of the web-site even after the Claimant had removed personal data from it, the Vice-Chancellor’s instruction had been based on a number of factors including the advice of Dr Knapton as to the likely requirements of the ICO pursuant to the Data Protection Act (reflected in the wording of the emails from Professor Hayward) and the related reputational and legal risk to the University. The instructions had been based upon all the information, and not only the advice from UIS, which the Claimant “repeatedly chose to disregard”.

[124]With regard to the factors taken into account by the disciplinary panel in deciding to dismiss, the appeal panel referred to the Claimant’s length of service and clean disciplinary record as well as the pressures upon him at the time with the conference in the US. It acknowledged that the Claimant had personally believed that taking down the web-site was a high risk strategy; and also that senior management’s instructions were not based upon an accurate understanding of the web-site or of the risks of taking it down. He believed it was an unreasonable instruction and that he was acting reasonably in not complying with it. However, the appeal panel considered that the disciplinary panel’s decision was appropriate.

[125]The fourth ground of appeal considered by the appeal panel was in relation to “new evidence” – effectively of an internal hack and evidence that Professor Hayward and others had attempted to malign his name and wanted him removed from his role. With regard to the possibility that the hack had been perpetrated internally Professor Parker took the view that this would have created an equal and possibly even a greater risk. With regard to Professor Hayward, Professor Parker and his colleagues did not consider that there had been an attempt to malign and remove the Claimant; and that, in any event, the decision to dismiss had been based on the Claimant’s conduct.

[126]The appeal panel accepted that the Claimant had a duty to assess the risk for the CSCP but that senior managers had responsibility for assessing the overall risk. The main issue for the University was that the CSCP web-site had a data security issue which had to be reported to the ICO. Advice had been taken from the Information Compliance Officer and the Senior Information Risk Officer and it had not solely relied upon information from UIS. Whilst the Claimant had eventually taken the web-site down, he had then reinstated it contrary to clear instructions. The appeal panel agreed that this amounted to serious misconduct. It also concluded that the decision to dismiss was appropriate in the circumstances.

[127]At the Tribunal hearing the Claimant sought again to argue that UIS officers had deliberately misled senior officers as to the technical risks of keeping the site up; and that their motivation in so doing was to assist Professor Hayward and/or others to transfer the project to the Cambridge University Press and, thereby, dispense with the Claimant’s services.

[128]I find that the possibility of transferring the project to CUP was under consideration before 22 June. There was a very real possibility that it was going to happen in any event, without requiring a plan to deliberately hack into the web-site as a means of raising serious questions about its safety so that it would have to be taken off-line. Those at CUP, supported apparently by Professor Hayward, did wish to see the project transferred and it is true that it was achieved sooner following the hack; but that was not a foreseeable or likely consequence of what occurred in June. The transfer was only expedited because the project needed to be managed and its Director had been suspended following his refusal to comply with an instruction from the ViceChancellor. That sequence of events could not have been predicted; particularly that the Claimant, having taken the site down, would put it back up again and be suspended. Furthermore, the Claimant alleges that as part of this conspiracy UIS deliberately misled senior management in order to assist the process of transferring the project to CUP. No-one has, however, given evidence of a link between CUP and UIS such that the latter would be prepared to lie in order to achieve this outcome for the former. There had been no previous hostility on the part of UIS to the Claimant; indeed, until 22 June 2016 he did not know who they were. I note also that in cross-examination, neither the Claimant nor Mr Smith was prepared to say in evidence that he believed that senior managers were involved in a conspiracy. Even if Simon Buck was responsible for the hack (and even if he cleansed some of the personal data before releasing it as the Claimant suggested, referring to page 590 of the Bundle), the likelihood that this scenario was manipulated by senior management in order to achieve the Claimant’s departure and the transfer of the project seems to me to be so low as to be discounted. It is highly unlikely that anyone would have conceived a plan which relied upon the Claimant responding as he did to instructions to take the site down. Furthermore, the decision to take it down was not immediate; and it was supported by Dr Knapton as well as UIS. In closing submissions, Miss Ismail sought to address the lack of evidence of an actual conspiracy in the following terms: “The Claimant does not say there was a big conspiracy. It’s a conspiracy of circumstances, rather than of people”. I have to confess to some uncertainty on my part as to what is meant here; but I am not able to find that there was a conspiracy of any kind (or that anyone deliberately lied) on the facts before me.

[129]In view of my finding in the previous paragraph I conclude that the principal reason for dismissal was the Claimant’s conduct. A secondary reason, in so far as it influenced the decision as to sanction, was the apparent failure of trust and confidence, which I find is some other substantial reason capable of forming the basis of a fair dismissal. Both are relied upon in the ET3.

[130]I turn, therefore, to the other issues for determination, one of which is that the decision to dismiss was predetermined i.e. that the decision had been made before the disciplinary panel met. That submission is based partly on the conspiracy theory which I do not accept and partly on the Claimant having been told by colleagues that they had been informed that he was “unlikely to return”. I accept that this may well have been the impression given to staff like Ms Tims who, with Mr Smith, would have been aware of the Claimant’s actions in restoring the site after being instructed to take it down and that he had subsequently been off work for an extended period. I accept that Ms Tims and others, if they inquired of Professor Hayward whether the Claimant would be returning, may have received a response that he personally thought it unlikely. It is not suggested that he said no. In any event, the decision whether or not to dismiss was delegated to the panel. I find that Professor Fentiman and his colleagues approached their task conscientiously and with an open mind. Indeed, they did not make their decision immediately after the first hearing, which they could and, in my view, would have done if it was predetermined. Instead, they spoke again to Professor Hayward and interviewed Mr Lovell. This indicates that they were still seriously considering their decision. Whilst Professor Hayward had by this time lost trust and confidence in the Claimant, he had not said so to the panel at the disciplinary hearing. I accept that Professor Hayward and others supported a move of the project to the CUP but this could have been achieved without dismissing the Claimant for misconduct. In any event, I have neither seen nor heard any evidence that this issue formed part of the panel’s considerations. I do not find that the decision to dismiss was predetermined.

[131]I turn next to whether the dismissal was procedurally fair and, if not, whether any defects were remedied by the appeal hearing.

[132]In the original pleadings, the Claimant raised by way of procedural defect the fact that Mr Tony Smith was not interviewed by Mr Dampier despite the Claimant asking him to do so. Mr Dampier did consider interviewing Mr Smith and discussed that possibility with HR. They advised him that it would not be normal practice to involve persons who were not employed by the University in a disciplinary investigation. Mr Dampier’s main reason for not doing so was, however, that he did not consider that Mr Smith had direct knowledge which would assist his investigation. The Claimant had not at this stage suggested that there was a conspiracy by UIS and others. He had the opportunity to bring Mr Smith to the disciplinary hearing if he believed he had relevant evidence to give; he chose not to do so. I do not, therefore, find that it was outside the range of reasonable responses nor a procedural defect for Mr Dampier to decline to interview Mr Smith.

[133]In closing submissions, Miss Ismail said that the most serious procedural defect was the failure to put to the Claimant the comments made by Professor Hayward by telephone. She bases this on the fact that Professor Fentiman and his colleagues held this conversation before they had reached a conclusion either on guilt or sanction. Professor Fentiman’s evidence, which was clear and which I accept, was that the panel decided whether the Claimant was guilty of the disciplinary charges, without reference to Professor Hayward’s comments; but that they did take them into consideration when considering sanction and, in particular, the issue of trust and confidence. They accepted that this had been “irreplaceably broken” by the Claimant’s conduct. Whilst it would have been preferable for Professor Hayward to be asked these questions while he and the Claimant were at the disciplinary hearing, I do not find that the decision to deal with it in this manner fell outside the range of reasonable responses or was a procedural defect; particularly as the same question was then put to the Claimant. It had no influence on the panel’s decision that the Claimant was guilty of serious misconduct.

[134]Ms Ismail, in closing, also referred to “another fatal defect” namely the holding of a discussion with Kieren Lovell without the Claimant in attendance. Had he been present, the Claimant would have had the opportunity to question Mr Lovell and, in his words, to prove him wrong. The Claimant was given a note of the interview and a reasonable time to consider it at the start of the reconvened disciplinary hearing. It is clear from the minute of that meeting that the Claimant discussed with the panel in detail everything he considered to be wrong about Mr Lovell’s answers. The panel accepted, for example, that Mr Lovell had been wrong about the link to the eHarmony web-site. I find that the decision to interview Mr Lovell and to put his answers to the Claimant was a conscientious attempt by the panel to seek to understand the difference of opinion on the technical issues. Ultimately, however, I accept Professor Fentiman’s evidence that they did not consider that this went to the heart of the issue and that Mr Lovell’s interview was not relevant to the decision they made. The instruction to take down the web-site had not been based solely on advice that the site was at risk of further hacking and should be taken down pending further investigation. It was based upon the perceived legal and reputational risk of not closing the site down on the premise that this would be expected by the Information Commissioner; and that fines might also be imposed.

[135]I do not, therefore, find that there was procedural unfairness.

[136]The next issue is whether the investigation was within the range of reasonable responses open to a reasonable employer. Although the issue was canvassed at length by the Claimant and raised by the disciplinary panel with Mr Lovell, ultimately the panel did not seek to reach a decision as to whether the Claimant or Mr Lovell was correct at the relevant time regarding the technical risks. The panel could have investigated this more thoroughly and sought to reach a conclusion. However, the principal disciplinary charge was that the Claimant had unreasonably failed to comply with reasonable instructions. Those instructions were not solely based upon the advice from UIS. They were escalated to the highest level in the University, namely the Vice-Chancellor. Ms Ismail said that the Claimant was “bombarded with instructions from increasingly senior people”. The Claimant accepted at the Tribunal hearing that he was aware that the reputational and legal risk which formed the rationale behind the instructions to take the site down until otherwise authorized was not based exclusively on the technical advice from UIS. It was, very importantly, based upon advice from the Information Compliance Officer and senior colleagues that the site had to be taken down in order to satisfy the Information Commissioner. Professor Fentiman and the panel agreed with Mr Dampier that it was the Claimant’s refusal to do this which was to be investigated. The technical arguments were material only to understanding the Claimant’s point of view but did not need to be resolved. His good faith and genuine difference of view as to which constituted the greater reputational risk – keeping the site operational or closing it down – was accepted; but the panel did not accept that the Claimant was acting reasonably in refusing to comply with instructions at the highest level because he disagreed with them.

[137]Despite the voluminous documentation and evidence presented to the disciplinary hearing, as well as the appeal hearing, it is a fact that the majority of the events in this case are not contested. They are clearly documented. This is particularly the case if the focus is upon the disciplinary allegations as formulated. I do not consider that the investigation was outside the range of reasonable responses.

[138]Having found that conduct was the principal reason for dismissal, I have no difficulty in concluding that the disciplinary panel genuinely believed that the Claimant was guilty of that conduct (which in its essentials is a matter of record).

[139]The next question is, therefore, whether the Respondent had, at the relevant time, reasonable grounds for believing that the Claimant was guilty of the misconduct alleged. I have little difficulty in finding that they did. Once again, the majority of relevant facts are clearly documented and undisputed. In particular, the Claimant initially delayed complying with the instruction, expressly stating that he understood it was an instruction but that he was not going to comply with it until he decided to do so. This led to the escalating bombardment referred to above and the fact that the Vice-Chancellor needed to become involved. Even if I were inclined to accept that the Claimant genuinely believed that Ms Finnegan had the authority to vary a clear instruction sent to him on behalf of the Vice-Chancellor (which I am not) the Claimant’s unilateral and unauthorised act of bringing the site back into operation less than 24 hours later in clear contravention of the Vice-Chancellor’s personal instruction is a matter of record. That was, according to the Respondent’s witnesses, the point at which the Claimant most clearly committed an act of serious misconduct. He had chosen to substitute his own view of what was in the best interest of the University for that of the Vice-Chancellor’s and his senior management. He also chose to disregard the requests of his line manager.

[140]The Respondent’s decision that the Claimant was guilty of serious misconduct in respect of the first of the three disciplinary allegations was, therefore, reasonably based upon the investigation and evidence before it. I will deal with the second and third allegations below.

[141]I turn first to the question of whether the decision to dismiss was one open to a reasonable employer in the circumstances, given that there is in most cases a range of reasonable responses available. The Respondent in this case first decided that the Claimant had deliberately disobeyed an instruction issued by the University’s most senior officer, its Vice-Chancellor. Indeed, the Claimant accepts that he did so – when put to him in cross-examination that this was in blatant disregard of instructions he replied: “Probably. It certainly wouldn’t help me”.

[142]The Claimant was also aware that an important reason why the University’s senior managers had issued this instruction was to satisfy the ICO and avoid serious reputational damage. Professor Fentiman and Professor Parker, in chairing their respective panels, both took the view that this was the key allegation. Was it fair to treat that conduct as a reason to dismiss the Claimant? The Respondent at both panels took into consideration the Claimant’s long service, his clean disciplinary record, and accepted that he had acted in what he believed was the best interest of the Project, but without paying due regard to the other risks, reputational, legal and financial following a breach of data protection. The Respondent took the view that it was crucial for a person in the Claimant’s position given a great degree of autonomy in the day-to-day management of the project, to accept the ultimate authority of the University even if he profoundly disagreed with its assessment. The Respondent was entitled to weigh heavily in the scales the fact that the Claimant showed no remorse and, indeed, stated that he would act in the same way again.

[143]I find that the Respondent took all relevant potential mitigation into consideration and that its decision to dismiss was one open to a reasonable employer in the circumstances.

[144]I would add, in respect of the second and third disciplinary allegations that they seem to me to add little. The second allegation, that the Claimant failed to respond promptly to the external solicitors’ letter, would not, in my view, stand alone as a fair reason to dismiss. The Claimant had only just arrived in the country after a long flight and, as the Respondent acknowledged, was under pressure. To expect a reply within an hour was demanding; and to treat the failure to do so as gross misconduct when he responded positively to all but one of the undertakings shortly thereafter, is not within the range of reasonable responses.

[145]With regard to the third allegation, that the Claimant failed to give an undertaking not to speak to third parties, is more difficult. He accepts that he failed to give the undertaking, stating that it was so widely drafted as to be onerous and impracticable. The Respondent argues that it was reasonable given the Claimant’s previous contact with the media but the undertaking is much wider than dealing with the media. It is arguable that this third allegation if taken alone would not be a sufficient reason to dismiss for a reasonable employer in the circumstances. However, the first disciplinary allegation was the principal allegation of misconduct from which the others flow. Considered in the round (as well as taking the first allegation on its own) I find that the decision to dismiss was within the range of reasonable responses. The evidence is that the Respondent did consider issues of mitigation as well as alternatives to dismissal but decided that the Claimant’s conduct, and his lack of regret, were such as to make his continued employment untenable.

[146]The Claimant also claims wrongful dismissal. In order to determine this claim I must make a finding as to whether the Claimant’s conduct was such as to constitute a fundamental breach of contract entitling the Respondent to dismiss without notice. I find that it was. The Claimant held the post of Director of a project bearing the University’s name and with an international consumer base. He deliberately flouted an instruction from the most senior person at the University not to bring the site back into use without permission. He was fully aware of the University’s concerns even if his own assessment was different. I accept that in relation to some of the safety issues his assessment may well have been proven right but the University was also concerned with the reaction of the Information Commissioner and the potential legal and reputational risk if they were not seen to be acting correctly. The Claimant’s decision to disregard those risks and restore the site less than 24 hours after reluctantly shutting it down was a blatant breach of trust and a fundamental breach of contract on his part. The wrongful dismissal claim must, therefore, fail.