Mr A Aden v St George’s University Hospitals NHS Foundation Trust: 6019039/2024
EMPLOYMENT TRIBUNALS
Case No 6019039/2024
Between
Mr A AdenClaimantSt George’s University Hospitals NHS Foundation TrustRespondent
Before
Employment Judge M Da CostaDate 12 January 2026
JUDGMENT
The judgment of the Tribunal is as follows: Complaint of unfair dismissal pursuant to section 111(1) Employment Rights Act 1996 contrary to section 94 of that Act[1]The claimant’s claim for unfair dismissal is not well founded and is dismissed.[2]The respondent had a potentially fair reason to dismiss the claimant within section 98(2)(b) of the Act.[3]The respondent acted fairly in dismissing the claimant for that reason because the respondent acted reasonably in treating the reason as a sufficient reason for dismissing the claimant within the meaning of section 98(4) of that Act. Complaint of wrongful dismissal contrary to the common law[4]The claimant’s complaint of wrongful dismissal is well founded and succeeds.[5]The respondent had the right to dismiss the claimant summarily without notice for gross misconduct but did not exercise that right. Instead, the respondent elected to continue its contract of employment with him by terminating that contract with notice. However, the respondent then failed to pay the claimant the amount of notice to which it purported him to be entitled to under that contract.[6]The respondent is ordered to pay the claimant the sum of £2,305.32 gross of tax and national insurance. This comprises 4 weeks’ pay in lieu of notice at £576.33 per week.[7]The claimant is responsible for paying any tax or National Insurance.
REASONS
[8]The claimant was employed by the respondent from September 2013 until 06/08/2024. He first started as medical lab assistant, then progressed to an advanced biomedical support worker and in his final role with the Trust, was a Device Support Technician in pathology IT. His role involved providing technical support, including access to and management of various IT systems used by the respondent’s staff.[9]On 06 August 2024, the claimant was dismissed by the respondent with six weeks’ notice pay. The allegations cited in the dismissal letter were that(1) unauthorised remote access attempts had been made from the PC belonging to the claimant to the PC used by Ana Sofia Silva Da Silva (a senior scientist of the Trust) and(2) that her password had been altered several times without authorisation by the claimant as a Winpath user. In relation to the first allegation the letter said that there was sufficient evidence that the claimant systematically and repeatedly targeted and remotely accessed the PC used by Ana Sofia without authorisation and that the claimant did not provide any evidence to support his reasoning that he was providing technical support. In relation to allegation 2 it stated that there was sufficient evidence that the claimant had systematically and repeatedly interfered with Ana Sofia’s Winpath password and account thus hindering her ability to work and process patient samples and results, that patient care and lab operations were impacted by his activities and that unnecessary distress was caused to Ana Sofia. It concluded that these amounted to gross misconduct as per the disciplinary policy of the Trust and constituted a breach of rule 3.2(g) and (y) of section 2 of the Trust’s disciplinary policy.
The Hearing
[10]I heard the case on 17 and 18 November 2025. I had the benefit of representation by counsel (Mr Downey for the claimant and Ms Urquhart for the respondent), and an agreed bundle of 492 pages including pleadings and orders, contractual documents, correspondence, Trust policies and additional documents, and written witness statements from the claimant, Mr Havel Ozgun and Mr Mohamed Jaeffer of the Trust, and a supplementary mitigation bundle. Mr Jaeffer and Ozgun and the claimant gave sworn oral evidence.[11]At the end of the second day of the hearing and with the agreement of the parties I reserved judgment. The issues for the Tribunal to decided – unfair dismissal[12]The claimant claims unfair dismissal.[13]There was no list of issues agreed between the parties prior to the hearing. It was not in dispute that the reason given by the respondent for dismissal was the claimant’s conduct within the meaning of section 98(2)(b) of the Employment Rights Act 1996. The claimant’s witness statement made it clear that, with regard to section 98(4) of that Act, his case was that the investigation and disciplinary procedure were fatally flawed, rendering the dismissal unfair. The claimant’s representative accepted that the “band of reasonable responses” test in Burchell 1978 IRLR 379 and Post Office v Foley 2000 IRLR 827 needed to be applied in this case in the normal way, namely that section 98(4) had to measured against the given reason for dismissal in light of(a) whether there was a genuine belief in the reason given,(b) whether that was based on reasonable grounds and(c) whether it was arrived at after a reasonable investigation had taken place. However, the claimant’s representative in his closing submissions elaborated specifically as to how the Tribunal should approach the test in light of the facts of this case in particular, as follows: (a) In this case the dismissal letter set out two specific terms of the respondent’s disciplinary policy. (b) The dismissal was predicated specifically on an assertion that the claimant had breached those two terms. (c) Therefore, what the respondent needed to establish was not only that the claimant had accessed the other computer in question remotely and taken actions in relation to his colleague’s account, but that in doing so he had actually breached the two parts of the disciplinary policy cited.(d) If the Tribunal found that the respondent did not sufficiently investigate the underlying content described by the two disciplinary terms relied upon for the dismissal, this would mean that they had not sufficiently investigated the reason for which they ultimately dismissed him. That underlying content would have to be both of whether (i) the access was unauthorised and (ii) it did actually result in him accessing confidential information for his own private or non-Trust purposes.(e) If (d) immediately above applied, the dismissal could not have been based on reasonable grounds and the investigation that lead to it could not have been reasonable, and it was possible that in these circumstances the respondent’s belief in the reasons given for dismissal were not genuine.[14]I agree with the claimant’s representative that the Tribunal should approach the Birchall test in the way described immediately above. I therefore agree that items (c), (d) and (e) immediately above are issues that the Tribunal must decide.[15]In his witness statement the claimant claims that the unfairness of the dismissal manifested in 8 separate ways under the categories “lack of motive”, “technical issues or bug not investigated”, “insufficient training”, “lack of balanced investigation among employees”, “failure to disclose evidence”, “disciplinary process not followed properly” and “harsh and unjust sanction”. Therefrom the following issues arose.(a) Lack of motive: Was it essential for the respondent to explore thoroughly whether the claimant had a plausible motive to sabotage Ms Silva’s computer access, and if so did they fail to explore this adequately or at all?(b) Technical issues or bug not investigated: Could the existence of an unresolved computer bug have potentially cleared the claimant of wrongdoing, and was this given appropriate consideration during the investigation. In light of this, was there an “assumption” of misconduct upon which it was unfair for the respondent to proceed?(c) Insufficient training: Were the claimant and his colleagues adequately trained to identify or resolve complex technical issues related to password management and system access and did any such deficiencies help to explain the situation that the claimant found himself in to be a result of system mismanagement rather than any intentional wrongdoing? Did the respondent unfairly disregard this point? In light of training issues alleged by the claimant, was the respondent’s ultimate conclusion that the claimant’s actions amounted to “mischief” an unjustified choice?(d) Lack of balanced investigation among employees: Did the respondent choose to investigate only the claimant, even though the colleague’s complaint did not identify anyone by name? Did the Respondent fail to review or assess the actions and access logs of the other IT Support Specialists, each of whom had the same level of access and responsibility? Did any failure by the respondent in this regard mean that the respondent unfairly singled the claimant out and conducted an investigation that lacked both balance and impartiality?(e) Failure to disclose evidence: During the investigation and the disciplinary process, the claimant made requests for various documentation, for example access to the WinPath logs and records of password change activity from the IT department. Did the Respondent refuse or otherwise fail to provide him with this information and if so, did that significantly limit the claimant’s ability to prepare a full and fair defence against the allegations?(f) Disciplinary process not followed properly: Did the respondent fail to follow the suspension process correctly? Did the respondent erroneously rely on the lack of HEAT tickets as evidence of malicious tampering?(g) Harsh and unjust sanction: Instead of dismissing the claimant, should the respondent have transferred him to a different department? In arriving at its choice of sanction, did the respondent fail to properly consider the explanations the claimant provided during the investigation? The issues for the Tribunal to decide – wrongful dismissal[16]The claimant claims wrongful dismissal. As above, was no list of issues agreed between the parties prior to the hearing. However, paragraphs 23 to 25 of the respondent’s opening note set out the issues clearly as follows:(a) Did the respondent do something that fundamentally breached the contract of employment between the parties?(b) Alternatively, did the claimant commit a breach of contract? Was it repudiatory such that the respondent was entitled to dismiss without notice in response?(c) The parties agree that the claimant would have been entitled to 10 weeks’ notice pay if he had not been dismissed. He was paid six weeks’ notice pay. Is the claimant entitled to a further four weeks’ notice pay? Chronology of events[17]In my judgment it is necessary in this case to set out below in detail the train of events during the investigation and disciplinary process. This is because the way in which the claimant and his representative have argued their case is highly specific as to allegations of pre-determination. There are diametrically opposed positions from the claimant and the respondent as to precisely what the reasons were for the events and the interpretation of how they unfolded. Conclusions would therefore in my judgment, not be transparently ascertainable by the reader without me setting out the detail below. In this “chronology of events” section I do not address any conflict of evidence because the section is designed as an explanation of matters as of record. References to page numbers, and numbers in square brackets, are to page numbers in the agreed final hearing bundle.[18]On 20 September 2023 Ana Sofia Silva emailed the SWLP IT helpdesk regarding a difficulty with logging into the WinPath application. The email (which stated that it was “to follow up on the phone call”) showed a screenshot of the relevant system logon dialogue box that appeared and said: “I’ve tried putting my username in both places and it told be [sic] account locked” [125]. On the same day her line manager Dawn Andrew raised a HEAT ticket number 608135 with SWLP IT helpdesk saying this [124]: “Ana Sofia is having issues daily with her Winpath login. Her password has been reset a number of times, but this has not helped. When she tries to log in, a System logon window appears which she cannot then log into. Could you please check the background settings on her account to see what is causing this. This causing [sic] significant disruption to AnaSofia’s [sic] working day.”[19]For the same day, 20 September 2023, a HEAT ticket entitled “Issues with Winpath login”, subject matter “For SWLP-IT” and for “customer Dawn Andrew”, with “owner” Abdullahi Aden and listed as “created on 9/20/23 20:38” is recorded as “completed” and “modified on 9/25/23 9:59” [121 and 123]. Mr Jaffer in oral evidence said that this correlated with the incident that Dawn Andrew raised documented at page 124, that “owner” meant the IT person to whom the task was assigned, and that the record showed the ticket as having been closed on 25 September 2023 at 09:59. The claimant in oral evidence agreed that he believed that was a task assigned to and resolved by him. Mr Jaffer said that the record on page 124 showed when the incident was raised but the task had not yet been assigned to an IT member of staff.[20]On 20 February 2024 Dawn Andrews raised with Mohammed Jaffer concerns about a potential cyber security breach to the cybersecurity team. The cybersecurity team then passed it back to Mr Jaffer after having no concerns of such a breach. Mr Jaffer then looked at the issues at a local level. All this is recorded not in the agreed bundle but in Mr Jaffer’s witness statement (see paragraph 6 thereof). But at page 126 is a record of how Ana Silva described her recollection of the problem to Dawn Andrew on 22 February 2024. Important parts of this are as follows: “My WPE password would not work and even when resetting it the same error (password incorrect) would show. For example on the 29.12 IT tried several methods of resolution including creating a brand new account only for the same issue to occur in the new account. IT found the account locked in a few occasions as well as some settings such as when the password is meant to expire and mandatory change of password each login different from what they were supposed to be however problem continued on and off. I also noticed movements on the computer that were not being done by me: Ex Mouse moving on the screen as well as documents been [sic] open and closed. Suspicion started that there was remote access happening as all these movements coincided with the WinVNC (blue eye icon) turning yellow and straight back to blue as soon as I moved the mouse myself. This happened on and off for a few days and on the 5.01 was able to see an iP address connected to the computer.”[21]Mr Jaffer says in his witness statement (see paragraph 7 thereof) that his initial investigation was not aimed at anyone in particular but rather to understand the causes of Ana Silva’s IT problems. He recounts considering the screenshot referred to by Ana Silva at page 126 and then reviewing her “account status (including password resets and history)” which he says appears at pages 105 to 123. What appears at pages 105 to 123 is in fact a log of connections made by IP address “192.168.120.73” to the computer that the respondent says Ana Silva almost exclusively used (pages 105 to 108), a screenshot of the electronic desktop of that computer showing a Notepad page with the same connections as at page 105 (page 109), and logs of HEAT tickets raised for the whole of the 2023 to 2024 fiscal year (pages 110 to 123). The “owner” of the majority of those tickets listed is the claimant but there are also other and many fewer references to other owners Richard Colman, Mohamed Nur, Aminur Rahman, Stephen Bunnage, Robert Tanner, Abdullahi Ileye, and Imraan Nazir. The Tribunal understood from Mr Jaffer’s oral evidence that the intention behind pages 110 to 123 was to ascertain(a) the frequency of HEAT ticket requests made specifically by Ana Silva to the claimant and(b) outside of that to investigate the nature of instances where staff had reported WinPad access and password issues generally to SWLP IT. Therefore, pages 110 to 123 were not designed to extract all of the HEAT tickets raised to the entire SWLP IT team in the given time frame, but instead to extract and quantify proof on the one hand of HEAT ticket interaction between the claimant and Ana Silva, and on the other hand to understand the nature of the wider nature of WinPad related interaction of staff generally with the wider SWLP IT team. The point being made in relation to the HEAT ticket entries where the claimant is the “owner” is that there was a paucity of HEAT ticket interaction between the claimant and Ana Silva.[22]The other fact-finding activity described by Mr Jaffer in his witness statement (see paragraph 8 thereof) was to conduct an audit of Ana Silva’s WinPath account and a log file showing the Claimant’s activity on that account. In two different forms (namely with blacked out redactions of usernames other than the claimant’s and then with those details not blacked out) provided at different times to the claimant, this document appears at pages 164 and 222 respectively.[23]Following his initial fact finding, Mr Jaffer held an informal fact-finding meeting with the claimant on 06 March 2024. By a letter dated 08 March 2024 and emailed to the claimant also on 08 March 2024 he wrote [128-130] to the claimant to confirm the outcome of the meeting. That letter was at the same time a letter of suspension.[24]On 13 March 2024 the claimant emailed Mr Jaffer in response to Mr Jaffer’s suspension letter [141-143]. He used the text of that letter and interpolated in blue type his objections. Relevantly, those included reference to:(a) Whether the claimant accessed Ana Silva’s computer remotely as follows: “As an IT support technician it is my role to support users remotely, what is the issue?” and “as per the allegations what are the unauthorised activities that you allude to? You need to be specific and state the foul play that has taken place, if any”.(b) Pre-determined conclusions, transparency and fairness, including “How do you expect me to recollect details of an event which you yourself haven’t shared any details of? […] I’m very sorry to say but this seems that I’m on the receiving end of an attempt to make a predetermined foregone conclusion”.(c) The questions that were asked of the claimant at the fact-finding meeting as follows: “Thirdly, you asked me three questions: “What do you do in the case where someone is having login issues”? and “Would you remote onto someone’s PC”? and “How would you remote onto someone’s PC”? and(d) The screenshot of activity on her computer supplied by Ana Silva at page 126 as follows: “…with regards to the picture you showed me during our “chat”. This was a black-white printout of an image that looked taken on a mobile phone […] This picture by the way, isolated a screen shot of my IP address whereas a proper audit would have shown much more information.”[25]On 13 March 2024 Mr Jaffer responded by email [138 and 139]. He reported that this was regarding a complaint raised by a member of lab staff and that the investigation would be done according to the HR processes. As to the potential ramifications he said: “You have confirmed that you are aware of the seriousness of the complaint, but you don’t remember why the actions were taken”. As to the questions asked at the fact-finding meeting, he said this: “I asked you the following questions. 1. What is the Path IT process for remoting into staff member’s PC? You stated the correct process. I have then shown you the screen shot of the IP address of the PC remoting onto the staff member’s PC, which is your office PC, and ask you the next question. 2. Can you tell me why you remoted onto the PC on that day, without any authorisation from the staff member who was using the PC? Your [sic] answered: I don’t remember. It could be to resolve an issue the staff member has. 3. Would there be any reason for you to lock someone’s WinPath account, without any issue raised by the user? You answered: No. I have then shown you a printed copy of the WinPath login setup audit trail with the (SIVAA03) account being locked a number of times, showing your login details (adenab00), as the person who took the action. I then asked you the next question. 4. Can you tell me why you have locked the specific staff member’s WinPath account (SIVAA03) on a number of occasions? You answered: I don’t remember. I asked you to try and remember anything on that the specific account or the person. You stated that you can’t remember anything. You also have stated to me that you don’t have any issue with the person.”[26]On 18 March 2024 the claimant responded to Mr Jaffer [137-138]. He repeated the allegations of pre-determination and that no evidence had been shared with him. As to the questions asked at the fact-finding meeting, he gave slightly more detail as follows: “Below are the exact questions you asked me and my responses. It's puzzling to me why you're altering the questions you asked and the entire interaction we had. I'm unsure of the significance of this, but I will maintain the accuracy of our conversation as it occurred: Question: “What do you do in the case where someone is having login issues”? My Answer: - we would reset their password and see if that fixes their issue, which it does most of the time. Question: “Would you remote onto someone’s PC”? My answer: yes if the issue is not resolved so we can correct them while observing to see where they are going wrong. Question: “How would you remote onto someone’s PC”? My Answer: - using the appropriate application that we all use.”[27]On 15 March 2024 Dawn Andrew wrote to the claimant [135] notifying of the start of a disciplinary investigation, that she would be the commissioning manager and had appointed Robert Akutu as the investigating officer to undertake the investigation. The letter said: “Following the allegation made against you; an initial fact finding and a review of the allegation(s) by a pre disciplinary investigation panel, a decision has been made to commission a formal investigation in order to establish facts of the case. The specific allegation(s) are: 1. It is alleged that unauthorised remote access attempts have been made from the PC belonging Abdullahi Aden (IP address 192.168.120.73) to the PC used by Ana Sofia Silva Da Silva. 2. It is alleged that Ana Sofia’s Winpath password has been altered without authorisation by Winpath user adenab00 (belonging to Abdullahi Aden) on numerous occasions.”[28]The Terms of Reference for the disciplinary investigation appear at page 145. They are dated 18 March 2024. By way of background they included: “Ana Sofia has noted that her WinPath password was locking out and requiring reset more frequently than anyone else in the department. She had also noted that unauthorised remote access was occurring to the PC that she uses in CBS. On one occasion, a screen shot of the IP address remote accessing her PC was captured before the access session was terminated” and “The disruption caused by the repeated reset requirements is impacting Ana Sofia’s ability to complete essential tasks.”[29]As to the allegations to be investigated, the Terms of Reference said: “Allegations 5 The Investigator is requested to investigate the following allegations (the "Allegations") against the Employee:5.1 Allegation 1: It is alleged that unauthorised remote access attempts have been made from the PC belonging Abdullahi Aden (IP address 192.168.120.73) to the PC used by Ana Sofia Silva Da Silva.5.2 Allegation 2: It is alleged that Ana Sofia’s Winpath password has been altered without authorisation by Winpath user adenab00 (belonging to Abdullahi Aden) as listed below:• On 12/09/2023 @ 17:52 the password of Ana Sofia’s SILVAA03 account was changed, and the account was locked – by adenab00 (which belongs to Abdullahi Aden) @ 18:03 the “password never expires” setting was changed to never expire for the SILVAA03 account by adenab00 @ 23:03 the SILVAA03 account was unlocked by adenab00• On 13/09/2023 @08:23 – the “Security Level” of SILVAA03 account was changed from MIC-6 to MIC-7, by adenab00• On 19/09/2023 @16:23 the SILVAA03 account was locked by adenab00• On 20/09/2023 @ 10:39 the SILVAA03 account was unlocked by colemt01 (Richard Coleman member of Path IT team) @16:43 the SILVAA03 account was locked by adenab00 @17:37 the SILVAA03 account was unlocked by adenab00• On 29/12/2023 @15:19 the SILVAA03 account was locked by adenab00• On 02/01/2024 @11:26 the SILVAA03 account was unlocked and “password never expires” setting was changed to never expire by colemr01”[30]On 25 March 2024 Robert Akutu wrote to Ana Silva inviting her to the investigation meeting set for 08 April 2024 [150 and 151] attaching the Trust’s disciplinary policy. In response Ana Silva emailed Robert Akutu to confirm she could attend [127 and 149] and described the problems she had been having in identical terms to those on page 126. On the same day Robert Akutu wrote to the claimant [153-155] inviting him to a disciplinary investigation set for the same day attaching the Terms of Reference and the Trust’s disciplinary policy. Also on the same day Robert Akutu wrote to Mr Jaffer [156-157] inviting him to a disciplinary investigation set for the same day attaching the Trust’s disciplinary policy. The minutes of those meetings are at pages 158 to 163 and are both signed 24/4/24. There is no written record of the 08 April meeting with the claimant.[31]On 15 April 2024 Robert Akutu emailed the claimant [167-168] thanking him for having attended the 8 April meeting and mentioning that he had not completed the investigation because there were a number of logs that the claimant had requested. He invited the claimant to a follow-up meeting on 19 April and attached those logs which were described as follows: “1. Log of your remote access. 2. A Summary of codes and an explanation of the codes. 3. A screenshot of logfile obtained from the PC in question with the IP address that belongs to AA. 4. WinPath User Set-up Audit with redacted usernames of other users 5. Abbreviations for the Security of Micro, BHI and WinPath.”[32]Items number 2, 4 and 5 are included within a composite single document that appears at page 164. It appears to me that item 1 must correspond to what is in pages 105 to 108. Item 3 refers to the screenshot of activity on her computer supplied by Ana Silva at page 126.[33]On 18 April the claimant responded by email [165-166]. He said that the documents were not the ones he needed, and that one of those he asked for was the log that had been showed to him in the fact-finding meeting of 08 April that had been “snatched back” from him at that time.[34]The minutes of the meeting with the claimant on 19 April 2024 are at pages 168 to 172 and are unsigned. They include the screenshot of activity on her computer supplied by Ana Silva at page 126.[35]Also on 19 April 2024 there was a meeting between Robert Akutu and Richard Coleman. The minutes of this are at pages 173-174. The minutes include the following exchange about a software bug: “RA - I need to provide a back story before I ask this next question. You've been invited to this meeting because a complainant was raised by Ana Sofia Gil Vieira Da Silva (AS), because the password was continually being locked/unlocked: So what would have prompted you to change her password without first raising a HEAT ticket? RC-I experienced this because the system has a 'bug', and Clinisys is aware of the problem. This affected me and three other staff members at Band 5, 7, and 8A levels. My account was continually locking so Clinisys created a new account. Since then, I have had no issues. EO - Was the bug fixed? RC-If I renew my password on my old account, it still locks me out. Outside of work, this has nothing to do with this investigation. I assigned AS a new account because of the bug, enabling her to continue her work. RC - No, the bug hasn't been fixed. RA - How many times will it take to lock a user's account? RC - The system routinely locks a user account after five times.”[36]The disciplinary investigation report was completed on 28 April 2024. It is at pages 175- 194. Important conclusions were stated as follows:(a) “There is unequivocal evidence that AA had accessed AS’s computer on several occasions. However, I could not see evidence that AS raised HEAT tickets nor that AA had responded to a call to resolve an IT related issue.”(b) “Although AS complained that she had several issues with her log-in and password access, I could not determine if AA had legitimate authorisation to access AS’s PC remotely, or to persistently change AS’s password.”(c) “A screenshot taken on the 5 January at 16:25 (Appendix 7), shows AA had obtained remote access to the PC used by AS. It was difficult to ascertain why there was a time lag of 5 minutes between the screenshot and remote connection to the PC used by AS.”(d) “It’s unclear why AA had made multiple connections and disconnections within seconds of one another. It was difficult not exclude an anomaly or some sort of software bug had randomly accessed AS’s PC.” And then later “This investigation was unable to determine if there is a bug, associated remote access to an individual’s PC.”(e) “It’s not standard practice to ‘lock’ a user’s account unless that staff member is leaving or has left the Trust and I could see no logical reason, for AA to lock AS’ account. However, there was no specific protocol that I could see at the time that clearly/explicitly defined when a user’s account should be locked. AA could have been providing genuine IT support or causing mischief.”(f) “There is unequivocal evidence that shows AA had used his username to modify AS’s Winpath password from lock to unlock and vice versa. However, it was unclear if this activity was to provide genuine support or to cause mischief. There is unequivocal evidence that shows AA had used his username to modify AS’s Winpath password from lock to unlock and vice versa. However, it was unclear if this activity was to provide genuine support or to cause mischief.”(g) “A bug was identified that is cable of locking accounts in WinPath, because RC’s had issues with his accounts being locked. However, when RC account was locked there wasn’t a username associated with the lock. Clinisys and RC resolved this issue by creating new account, since then RC has not had any issues. In this instance it’s clear this bug is not associated with a named individual, so this issue is unrelated to activity associated with AA’s username.”[37]It is apparent from pages 198-199 that Mr Jaffer had investigated the issue of a software bug at some stage. The exact time frame is difficult to ascertain. However, page 198 is an email from Richard Coleman to Mr Jaffer dated 10 May 2024 about it, referring to an associated enclosed email from a Yanita Gateva (IT Technical Lead Interoperability and Interfaces at SWLP IT). This was passed on to Robert Akutu [page 198] in an email which shows no date. In summary, the information conveyed was:(a) The RD Web WPE account required password reset almost every time which prevented Ms Gateva from doing her work. This was because she had to type her RD Web password twice which triggered the security lock, meaning that she had to log out and ask colleagues to unlock and re-set her password. Clinysis forwarded the query to Telefonica Tech who gave a new password and since then she had no issues.(b) Richard Coleman experienced his issue 2 years ago (so 2022) and his solution was to be provided with a new account. Ms Gateva and other staff who had the same problems were not issued with a new account but instead it was recommended that another web browser be used to access RDWEB.(c) Those issues experienced by Richard Coleman and Ms Gateva were different from the WinPath issues that Ana Silva had.[38]On 20 May 2024 Mr Faizur Rehman wrote to the claimant [200-202] notifying of the outcome of the disciplinary investigation. The allegations listed were as follows: “Allegations 1. Unauthorised remote access attempts to a PC 2. Unauthorised alteration of WinPath access levels and locking/unlocking of account belonging to Ana Sofia.” As “examples” of the allegations, not all of the instances of alleged interference that were listed in the Terms of Reference were repeated. The decision was summarised as follows: “Sufficient evidence has been found to support examples of the allegation of unauthorised remote access to a PC and unauthorised alteration of user account belonging to Anna Sofia. Therefore, there is a requirement to proceed to a disciplinary hearing to give you an opportunity to present your case to the chair of the panel.”[39]On 28 May 2024 Mr Haval Ozgun wrote to the claimant [203-205 and 221] inviting him to a disciplinary hearing set for 06 June 2024. The letter framed the findings of the investigation as that “there was sufficient evidence to support the allegation(s) made against you and there is a case to answer”. The “specific allegations” that the letter stated “would be heard” were quoted as follows: “Allegation 1: It is alleged that unauthorised remote access attempts had been made from the PC belonging to Abdullahi Aden (IP address 192.168.120.73) to the PC used by Ana Sofia Silva Da Silva. Allegation 2: It is alleged that Ana Sofia’s Winpath password had been altered several times without authorisation by Winpath user adenab00 (belonging to Abdullahi Aden)” It was stated that the allegations cited “may constitute a breach of” the “following Trust’s disciplinary rules:• “Unauthorised access or disclosure of or use of confidential or personal information relating to the business of the Trust, its employees or the public with whom it has dealings, including disclosing confidential or personal information concerning patients/clients. This includes disclosing such information on chat rooms, websites, and social networking sites.• Harassment or bullying behaviour towards a colleague, patient, or member of the public.• Unauthorised use of any of the Trust's workforce, equipment, materials, and/or facilities for private, non-Trust, or improper purposes. This includes but is not limited to, inappropriate use of the Trust’s computer and information network including inappropriate use of the internet and email systems such as accessing, displaying, or storing offensive images or sending emails likely to cause offence or bring the Trust into disrepute or sending emails in breach of confidentiality or data protection obligations.”[40]On 3 June 2024 the claimant emailed Mr Ozgun confirming his attendance at the disciplinary hearing [221-222]. At the same time he asked for documentation that was “being used against” him. Specifically, he asked for “the full official written complaint made by Ana Sofia in September 2023” and “the full, unedited audit log which I’ve previously seen containing multiple names making changes to Ana Sofias [sic] account – names such as Richard and Imran”. He also asked for his access to be reinstated to all systems. Mr Ozgun replied on 3 June 2024 [220] referring him to the full investigation report which “contains all the evidence used in the investigation and the conclusion reached by the investigating officer” and saying it was not possible to reinstate his access to Trust and SWLP IT systems at this stage. Email correspondence then followed, also involving the claimant’s Union representative, which resulted in [212-215 and 210]:(a) Confirmation that although there is no initial letter of complaint from Ana Silva against the claimant, it is stated in the investigation report that the investigation was commissioned when Ana Sofia reported suspicious activity and frequent locking of her account to her line manager which triggered the investigation.(b) The full, unedited log being agreed to be provided without any redaction.(c) The full remote access log without redaction being provided to the claimant’s Union representative with a breakdown by email of numbers of connection incidences by date.(d) The full hearing pack being sent to the claimant by post [215].(e) The disciplinary hearing was postponed so as to allow claimant to review all the documentation sent to him.[41]The decision following the disciplinary hearing was to dismiss the claimant. That decision was made by Mr Osgun (something which he confirmed in oral evidence). There followed an internal exchange of correspondence between Mr Osgun and the HR Directorate where edits were agreed to the draft dismissal outcome letter before it was sent to the claimant. The letter was sent by HR to the claimant on 25 June 2024 [262]. The conclusion of the letter, after the allegations were stated to be upheld, was that the claimant’s activities in question amounted to a breach of the same disciplinary rules from the Trust’s policy as set out in the first and third bullets of the letter of 28 May 2024 that Mr Haval Ozgun wrote to the claimant [203-205 and 221] inviting him to a disciplinary hearing set for 06 June 2024 (see paragraph 39 above).[42]The allegations as set out in the disciplinary hearing outcome letter were: “Allegation 1 - Unauthorised remote access attempts had been made from the PC belonging to Abdullahi Aden (IP address 192.168.120.73) to the PC used by Ana Sofia Silva Da Silva. Allegation 2 - Ana Sofia’s Winpath password had been altered several times without authorisation by Winpath user adenab00 (belonging to Abdullahi Aden).”[43]Under the “evidence presented by management” heading, the disciplinary hearing outcome letter went into detail about the activity that was considered. Here, it set out the identical instances as set out in the Terms of Reference (see paragraph 29 above).[44]In relation to allegation 1 a conclusion of the disciplinary hearing outcome letter was that “the excessive remote access made by you was aberrant and not in line with usual practice” and “other members of the team had also obtained remote access occasionally to troubleshoot but not to the extent of your activity and certainly not to that PC in particular”. In relation to allegation 2 a conclusion was this: “…by locking Ana Sofia’s Winpath account, often while she was on duty, you hindered her ability to perform her day-to-day duties which included processing patient samples, reviewing, and releasing patient results, and monitoring analyser performance. This impacted patient care and caused distress to her while on duty. I asked the management to clarify whether it was necessary to lock someone’s account or remotely dial into a PC to troubleshoot. The management confirmed that it was not necessary to do so.”[45]The disciplinary outcome letter also set out questions that had been asked by the claimant in the disciplinary hearing along with the answers of the respondent. In relation to one of these as to whether the respondent had investigated the activity of other members of the SWLP IT team on Ana Sofia’s account it said: “…no one in the team had locked Ana Sofia’s account. Other team members had provided technical support by unlocking her Winpath account when it was locked by you on several occasions and reset her passwords. No one else in the team had ever locked her account but you.”[46]The summary decision set out in the disciplinary outcome letter in relation to each allegation were as follows: “Allegation 1 – I upheld this allegation There was sufficient evidence that you systemically and repeatedly targeted and remotely accessed the PC used by Ana Sofia without authorisation. You did not provide any evidence to support your argument and reasoning that you were providing technical support. Allegation 2 – I upheld this allegation There was sufficient evidence that you had systemically and repeatedly interfered with Ana Sofia’s Winpath password and account thus hindering her ability to work and process patient samples and results. Patient care and lab operations were impacted by your activities which also caused unnecessary distress to Ana Sofia.”[47]The claimant exercised his right to appeal against the dismissal. I do not set out the history of that appeal here because it is not relevant to the issues before the Tribunal. That is because the grounds the claimant’s claim to this Tribunal do not relate the internal appeal stage except insofar as his consistent request for the “full WinPath log which was briefly shared with me on April 8th”. Suffice to say here that the internal appeal was not heard until 26 November 2024 and the result notified on 17 December 2024. The internal appeal hearing had been set for 5 different occasions in total, some due to the respondent (relevant people unavailable) and some due to the claimant’s refusal to attend until because he had not been provided with the full WinPath log mentioned in this paragraph.
Findings of fact
[48]Did the claimant access Ana Silva’s computer remotely? The evidence upon which the respondent relied to assert that the claimant accessed Ana Silva’s computer remotely was her email at page 126, her investigation meeting at page 159, the screenshot at page 170, the list of connections at pages 105-108 and the screenshot at page 109. The claimant was taken to all these in cross-examination. His responses in cross-examination were a mixture of admissions, denials and equivocal answers. Specifically, he said that he could not recall his IP address off by heart. There was an outright denial (when his answer to the final “RA” question at the bottom of page 169 was put to him where he accepted having remote access for authorised activity) that the screenshot at page 170 proved access by him. Another outright denial was where he said his comment at page 226 “I did look at her account” was incorrect. A further denial was a denial of the proposition that his comment at the bottom of page 142 “it is my role to support users remotely, what is the issue” constituted an admission of access to her account. His account on several occasions in oral evidence was that at no time had the respondent provided him with data about who had logged onto the generic computer used by Ana Silva at the times listed on pages 105-109. The other argument, emerging via cross-examination of Mr Jaffer, was that the IP address 192.168.120.73 listed at pages 105-109 did not necessarily prove access in every instance by the claimant because that computer was shared by all SWLP IT staff. Mr Jaffer’s evidence in response was that the desk where the computer with IP address 192.168.120.73 was stationed was the claimant’s dedicated desk and that there were dedicated PCs and desks for staff members for SWLP IT and 2 other shared PCs for the informatics team (data analysts). I find that the evidence of the respondent as to the fact of remote access to Ana Silva’s PC is cogent and wholly coherent, whereas the evidence given by the claimant is inconsistent and evasive. For that reason, I make the following findings of fact:(a) Subject to paragraph 49(d) immediately below, on the balance of probabilities all the remote connections listed at pages 105-109 were connections made by the claimant to the computer used by Ana Silva.(b) Even if the computer used by Ana Silva was a generic one used by lab staff, that does not rule out that the connections listed at pages 105-109 were made when she was using the computer.(c) The screenshot of the connection at page 170 proves remote access by the claimant to the generic lab computer at the time Ana Silva was using it to access Trust data via WinPath.[49]Was the access by the claimant to the computer used by Ana Silva unauthorised? The evidence upon which the respondent relied to assert that the claimant’s access to Ana Silva’s computer was unauthorised was again her email at page 126, her investigation meeting at page 159, and the screenshot at page 170. In addition, it was the proposition that the number and frequency of the connections at pages 105-109 were wholly out of the ordinary and unnecessary. Also in addition, it was the evidence over pages 110-122 that there were a paucity of HEAT tickets proving the existence of IT issues raised by Ana Silva to the claimant. Finally, there was the fact that never during the investigation did the claimant provide evidence (via texts or call records to his mobile) of contact outside of the HEAT system between Ana Silva and himself in relation to IT support issues. In cross examination the claimant’s evidence was clear that any access he made was at all times authorised and that Trust customers did approach him via channels outside of HEAT. The other suggestion put by the claimant via his representative in cross-examination of both the respondent’s witnesses was that the frequency of connections to the computer used by Ana Silva could be attributable to a computer bug. I find as a fact that the on the balance of probabilities the claimant did access Ana Silva’s account when not authorised to do so by Ana Silva. I find this on the basis that:(a) On the face of it, the evidence at pages 126 and 159 and 170 taken together holistically is clear and coherent proof of unauthorised access by the claimant and here is no reason I can see to doubt it.(b) No evidence was ever, including in oral evidence at the hearing, provided by the claimant proving to the contrary (there were only bald denials).(c) It is possible that not all contact between Trust customers and SWLP IT was done within HEAT system but this does not vitiate the evidence provided by Ana Silva in relation to some access clearly being unauthorised.(d) I am not in a position to determine, on any standard of proof, whether as a matter of fact any or all of the connections listed at pages 105-109 were attributable to a computer bug.(e) However, even if a bug were responsible for some of the connections at pages 105- 109, that cannot possibly account for the screenshot at page 170.[50]Did the claimant take actions in relation to Ana Sofia’s WinPath account status and were they authorised by Ana Silva? The primary, direct evidence upon which the respondent relied to assert that the claimant altered the status of Ana Silva’s account is at pages 164 and 222. The claimant’s oral evidence in the hearing was crystal clear that he did take those actions. I find as a fact accordingly. In relation to whether the actions listed on those pages were authorised by Ana Silva, her evidence at page 159 is crystal clear. There, asked the question “have you ever contacted Abdullaahi to help reset or lock your account?” she replied “definitely to reset and deal with IT related queries but not to lock my account”. The claimant’s oral evidence was also crystal clear on this point, namely that there was no sinister reason for locking her account and that this was part of routine IT support. Accordingly, I find as a fact that the actions at page 222 labelled as “Lock/unlock” were (even if the claimant is correct as to there being nothing sinister about it) not authorised by Ana Sofia.[51]Did the actions by the claimant on Ana Sofia’s account result in him accessing confidential and/or patient information for no legitimate reason? The primary, direct evidence relating to this is at page 126 where Ana Sofia said in her email to her line manager on 22 February 2024 “I also noticed movements on the computer that were not being done by me: Ex Mouse moving on the screen as well [sic] documents been [sic] open and closed”. Further, at page 170 behind the screen shot tabs can be seen as well as a box entitled “Quick search”. Mr Osgun’s oral evidence was that this showed the ability of IP address 192.168.120.73 to open material that could contain confidential patient information. On this basis, I find that the claimant had the ability to access confidential Trust data relating to patients and that, on the balance of probabilities it is more likely than not that the claimant accessed such confidential Trust data for purposes unconnected to his role as IT support as a result of unauthorised access. The relevant law – unfair dismissal[52]Section 94 of the Employment Rights Act 1996 gives employees the right not to be unfairly dismissed. Enforcement of the right is by way of complaint to an employment tribunal under section 111. The claimant must show that he was dismissed by the respondent under section 95, but in this case the respondent admits that it dismissed the claimant under cover of a letter emailed to him on 25 June 2024.[53]Section 98 of the 1996 Act deals with the fairness of dismissals. There are two stages within section 98. First, the employer must show that it had a potentially fair reason for the dismissal within section 98(2). Second, if the respondent shows that it had a potentially fair reason for the dismissal, the Tribunal must consider, without there being any burden of proof on either party, whether the respondent acted fairly or unfairly in dismissing for that reason.[54]Section 98(4) then deals with fairness generally and provides that the determination of the question whether the dismissal was fair or unfair, having regard to the reason shown by the employer, shall depend on whether in the circumstances (including the size and administrative resources of the employer’s undertaking) the employer acted reasonably or unreasonably in treating it as a sufficient reason for dismissing the employee; and shall be determined in accordance with equity and the substantial merits of the case.[55]In misconduct dismissals, there is well-established guidance on fairness within section 98(4) in the decisions in Burchell 1978 IRLR 379 and Post Office v Foley 2000 IRLR 827. The Tribunal must decide whether the employer had a genuine belief in the employee’s guilt. Then the Tribunal must decide whether the employer held such genuine belief on reasonable grounds and after carrying out a reasonable investigation. In all aspects of the case, including the investigation, the grounds for belief, the penalty imposed, and the procedure followed, the Tribunal must decide whether the employer acted within the band or range of reasonable responses open to an employer in the circumstances. It is immaterial how the Tribunal would have handled the events or what decision it would have made, and the Tribunal must not substitute its view for that of the reasonable employer (Iceland Frozen Foods Limited v Jones 1982 IRLR 439, Sainsbury’s Supermarkets Limited v Hitt 2003 IRLR 23, and London Ambulance Service NHS Trust v Small 2009 IRLR 563).[56]In this case it is not in dispute that the respondent dismissed the claimant because it believed he was guilty of gross misconduct. However, this was not altogether a straightforward point. In his closing submissions the representative for the claimant argued that the belief held by the respondent was, in truth, not that he had accessed Ana Silva’s computer or changed her password but instead was more that he had accessed that computer to access confidential information for his own private or non-Trust purposes. He developed that point by arguing that alleging breach of the Trust’s disciplinary code without proving the cause for the claimant’s access calls into question whether the respondent’s belief was a genuine belief. Allied to this was his argument that at a very early stage the respondent had pre-determined its position. So, in effect, and he stated this in terms, his argument was that the respondent did not possess reasonable grounds for the belief that it had asserted.[57]In light of how the point on “genuine belief” was argued by the respondent’s representative in closing submissions, I have taken the view that his observations about belief go to the issue of whether in all the circumstances the respondent acted within the band or range of reasonable responses open to an employer in such circumstances. For that reason I have decided that, since conduct is a potentially fair reason for dismissal under section 98(2), and either way (namely regardless of whether the respondent’s belief was access to a computer and password changes, or access to confidential information for private or non-Trust purposes), the respondent has satisfied the requirements of section 98(2) since all variations go to “conduct” as a whole. The relevant law – wrongful dismissal[58]Wrongful dismissal is a common law contractual matter that is engaged when an employer breaches the employee’s contract by failing to give the notice of termination to which the employee is entitled under the contract. This can occur when the employee is dismissed summarily without notice or is dismissed otherwise with less notice to which they were entitled under the contract. The amount of notice to which an employee is entitled should be set out in the written statement of employment particulars which employers are required to give employees under section 1 of the Employment Rights Act 1996. If there is an express contract term as to notice (written or orally agreed), this will apply, provided this is not less than the period of notice required by section 86 of the Employment Rights Act 1996 (namely, after the employee has been employed for at least one month, one week, then one week for each completed year of service up to a maximum of 12 weeks). If there is no expressly agreed period of notice, there is an entitlement at common law to “reasonable” notice of termination which must not be less than statutory minimum notice in section 86.[59]An employee will not be entitled to notice of termination if they have fundamentally breached the contract, for example if the contract is terminated because the employee is guilty of gross misconduct. Discussion and conclusions – unfair dismissal[60]Ms Urquhart provided me with an opening note which at its paragraphs 8 to 10 set out the legal issues which she said the Tribunal had to decide. Then both she and Mr Downey made closing oral submissions on fairness within section 98(4) which I have considered and refer to where necessary in reaching my conclusions.[61]In terms of the way in which in this particular case the claimant’s representative says I must approach the reasonableness test in Burchell 1978 IRLR 379 and Post Office v Foley 2000 IRLR 827, see paragraphs 13 and 14 above. This is addressed below.[62]Furthermore, as to the said reasonableness test, below I address each of the claimant’s grounds as set out at paragraph 15 above.[63]Where I have had to resolve any conflict of evidence, I indicate how I have done so at the material point. Again, references to page numbers, and any numbers in square brackets, are to the agreed final hearing bundle.[64]In relation to motive:(a) The claimant argues that it was essential for the respondent to explore thoroughly whether he had a plausible motive to sabotage Ana Silva’s computer access and that they failed to do so. The respondent argues that there is no need to establish motive and that it was reasonable for the respondent to look at the audit trail to see what had occurred, and that they were not wrong to take a decision following the evidence, even if there were no apparent motive.(b) I agree with the respondent’s submission. In my judgment it was reasonable in this case for the respondent to confine itself to establishing (a) whether there was unauthorised access and (b) how that correlated to the respondent’s disciplinary policy. Mr Jaffer’s oral evidence, which the claimant did not dispute under crossexamination, was that the investigation did not start with any suspicion specifically on the claimant but was pursued as a result of the difficulties Ana Sofia was having and after a cyber attack had been ruled out as the cause of those.(c) Notwithstanding, I find that the respondent did as a matter of fact investigate motive to the best of its ability. At page 158 when Ana Silva was interviewed as part of the factfinding exercise, she was asked specifically what her relationship was with the claimant outside of the organisation. She confirmed it stopped from March 2024 “even if it was work related”. Then asked on page 159 why she thought the claimant would access her account unauthorised, she suggested it could be “to try and start a conversation, I think”. In parallel, the claimant was asked the very same question at page 169 during the fact-finding meeting and responded that it had “nothing to do with this investigation”. Those interactions were then flagged by the investigating office Robert Akutu [183, 184, 188, 189] and referenced to the claimant again in the disciplinary meeting [224 and 225] where at page 224 Robert Akutu explained why it might be relevant (i.e. working contact out of hours) and [225] he reported he had seen the relevance “from AS expression”. Furthermore, the claimant’s position as to motive was inconsistent, on the one hand alleging motive was irrelevant and on the other [227] alleging that Ana Silva might have framed him. In my judgment, it is not open to the claimant on the one hand to allege lack of investigation of motive as a deficiency in the fairness of proceedings, at the same time as clearly having denied motive as a possible causative factor during those proceedings. In the absence of any evidence about motive having been found by the respondent, it was in my judgment entirely reasonable for the respondent to proceed to investigate anyway, given the context of (i) a recent cyber attack, (ii) apparent irregular activity and (iii) the overarching need to preserve patient confidentiality.[65]In relation to technical issues allegedly not investigated:(a) The claimant’s argument in his witness statement, closely backed by his representative’s closing submissions, was that the investigation was fundamentally flawed because the existence of an unresolved computer bug (see at paragraph 35 above RC answer “no, the bug hasn’t been fixed”) that could potentially have cleared the claimant of wrongdoing was not sufficiently investigated. This, he argues, is one of the root causes of a faulty “assumption” made early on by the respondent that he must have been guilty of misconduct, that then pervaded the whole investigation. Specifically, the closing submissions were that the respondent knew there was a bug that caused locking and unlocking with other individuals and that this was potentially highly relevant to the complaint as first described by Ana Sofia. He submitted that when one scrutinises the problems as reported by Ana Sofia in September 2023 and then again in February 2024 looking back to December 2023, there was every reason to suspect IT was involved in resolving the problem reported shortly after Christmas 2023, which is a good reason to explain in innocent terms the claimant’s activity on her account as detailed on page 222. The suggestion was that the respondent either failed, or perhaps even wilfully ignored, that context even after it had been raised at an early stage by Richard Coleman because it relied instead and wholly on the logs and the lack of HEAT tickets at pages 105 to 123 which told a story that it continuously deliberately preferred. In this connection the claimant prayed in aid the conclusions of the investigating officer Robert Akutu in his report at paragraph 36(d) and (g) above. In contrast, the respondent’s submission was that the potential significance of the bug had been considered and rightly dismissed because there was a simple explanation (see at paragraphs 35, 36(g) and 37 above), meaning that it had been correctly identified as a red herring.(b) I do not accept the claimant’s submissions about the bug relating to locking of accounts. True it is, that it is not certain when (see paragraph 37 above) the bug referred to by Richard Coleman in his investigation interview (see paragraph 35 above) was first investigated. But in any event it is clear from the investigating officer’s report (see paragraph 36(g) above) as at 28 April 2024, which preceded any decision that there was a disciplinary case to answer, that the bug identified was not the cause of the activities of the claimant in the log at page 222. It was those activities that, as can be seen from my chronology above formed an unbroken chain that connected the fact finding, the investigation, the disciplinary interview and the content of the dismissal letter (the links in that chain being paragraphs 22, 23, 25, 28, 29, 38 and 39 above). Cogent oral evidence was given at the hearing by Mr Jaffer and Mr Osgun that the RDWEB issues raised by Richard Coleman in his investigation interview were concerned with access to the external server where the Winpath application was stored, whereas Ana Sofia’s inability to log into Winpath was caused by local changes (namely not changes on the RDWEB level) which it had been ascertained were caused by the claimant. I therefore cannot agree that the unresolved IT bug had any realistic potential in the mind of the respondent to cast legitimate doubt on the reasons that they took forwards for investigation, or that it realistically contributed to any unreasonable assumption on the part of the respondent.(c) Another IT related issue was raised by the claimant’s representative to the effect that the remote access instances listed at pages 105-109 (as opposed to the account locking) and relied upon heavily by the respondent throughout their investigation and disciplinary proceedings were open to question and that the respondent failed to investigate this aspect, with a material detriment to the claimant. This he put heavily to Mr Jaffer and Mr Osgun in cross examination. In terms of documentary evidence he prayed in aid the investigating officer’s conclusion at paragraph 36(d) above. I do not accept the claimant’s submissions as to this. The responses given in crossexamination by Mr Jaffer and Mr Osgun, which were that a connection resulting in a page 105-109 record could potentially be as quick as a click of the mouse and could be overridden by a click of the mouse of Ana Sofia or by another legitimate connection by Richard Coleman, were in my judgment credible. At the time of the investigation, outside of the comment of the investigating officer at paragraph 36(d) above, there was no indication communicated to the respondent by anybody that the remote connection aspect (as opposed to the password locking aspect) was the subject of any bug. In the absence of such an indication, it was in my judgment reasonable for the respondent to rely on the logs at pages 105-109 in taking forwards the investigation. The investigating officer’s conclusion at paragraph 36(d) above was not corroborated at the time of the investigation by any other evidence of a computer fault of that nature. In any event, as per my finding of fact at paragraph 49(e) above, the respondent in my judgment had reasonable cause to doubt that conclusion.[66]Insufficient training:(a) The suggestion put to Mr Jaffer in cross-examination was that nowhere in the Trust’s Standard Operating Procedure [start page 365] or the WinPath User Account Password Reset guidance [start page 393], indeed nowhere in the whole bundle, did there ever appear any guidance that accounts should not be locked during routine IT support. This echoed the claimant’s statement at page 225 that the investigating “stated that there is no SOP that states that an account should not be locked officer”. This accorded with the claimant’s clear evidence in the investigation meeting [page 171] that it was routine to lock and unlock an account as part of IT support, which he repeated in oral evidence at the Tribunal, and page 225 of the bundle where he stated in the disciplinary meeting that “I haven’t had proper training in Winpad”.(b) However, there was evidence available to the respondent during the investigation that contradicted the claimant’s position that locking formed part of routine IT support. At page 174 Richard Colman stated that it was not routine to lock an account and that this would only be done when a member of staff left the Trust. The same was repeated by Faizur Rehman during the disciplinary meeting [224] where he also said that an account could not be worked on by IT when it was locked, and that [226 and 227] no other member of the IT team had locked accounts for IT work (though they had unlocked them). At the same time, the evidence given by the claimant to the Trust on this point was inconsistent. At page 225 he said it was a “rare case” to lock an account, at page 227 that he did “not always” lock an account to set a password, and Mr Jafffer’s recollection (see paragraph 25 above) of the initial fact finding meeting was that the claimant had said he would not have any reason lock an account. The conclusion that locking an account did not demonstrate genuine IT support was reached by the investigating officer in his report (see paragraph 36(e) above). Repeatedly throughout the investigation and disciplinary proceedings it was put to the claimant that the timings of the account locking in question (for example on 30 March 2023 when Ana Silva was not on duty, at 23:03 on 12 September 2023 and overnight between 19 September 2023 and 20 September 2023) did not make sense and were highly irregular, his only answer being that it was routine IT support. Given the cogent body of evidence before it and the failure of the claimant at all times to provide any compelling reasons to the contrary, my decision is that it was reasonable for the respondent to come to the conclusions to which it came regarding the lack of any need to lock Ana Silva’s account. I consider that, given the evidence presented to the claimant during the investigation, it was right for the respondent to take it as incumbent on the claimant to provide any innocent explanation for locking Ana Silva’s account, if there was one. The claimant’s assertions to the contrary were, even before the Tribunal, bald denials unsupported by any evidence.(c) The evidence given about training more generally at the Tribunal hearing by Mr Jaffer was that the claimant was given the same training as the rest of the SWLP IT team, that cascade training was given regarding user and password management, that the training did not show any need for account locking and that senior approval was required to lock an account. The claimant did not dispute this.(d) The submission of the respondent’s representative was that training had not been raised at any time by the claimant until the disciplinary hearing, which is correct as recorded on the face of the documentary evidence before the Tribunal. In oral evidence at the Tribunal the claimant disputed this, saying that he did raise training at the investigation meeting with Robert Akutu, as well as at both fact-finding meetings with Mr Jaffer and in the disciplinary meeting and even (so the suggestion seemed) at other times previous to the investigation having started. Of those claims there is no documentary evidence. The claimant seemed to be inferring at the Tribunal hearing that the records in the hearing bundle are not complete or reliable. But under crossexamination at the Tribunal, in terms of general competency with his job the claimant conceded “Yes I knew what I was doing”. Looking at the body of evidence as a whole and taken against the background of the clear evidence of the lack of any need to lock accounts during routine IT, I prefer the submission of the respondent. The claimant said under cross-examination that he and Imraan Nazir had gone to Richard Coleman and Aminur Rahman for help with matters that they could not resolve. His representative in closing submissions suggested that the fact that on 20 September both the claimant and Richard Coleman interacted on Ana Silva’s account is probative of innocent interaction. He could also have submitted that the common interaction on that day was evidence of the claimant going to Richard Coleman because he did not know how to resolve a WinPath access problem that was raised to him on that day. But equally it could also be evidence of Richard Coleman resolving, by way of unlocking, a WinPath access problem that the claimant had deliberately caused. Taking the body of evidence as a whole, I find as a fact that it was evidence of the latter.(e) I do not accept the claimant’s submission that lack of training contributed to his practice of locking accounts. There is nothing in any of the Trust’s policy documents disclosed in the hearing bundle that suggests any need for account locking during the course of IT support. As above, there is cogent evidence to the contrary. At no stage, including at the Tribunal, has the claimant ever offered any cogent evidence that he was unable to discharge any of his core duties due to lack of training, or that he escalated to his superiors any training needs regarding account locking/unlocking or password change procedures.(f) For the reasons above I cannot accept that there was before the respondent at any time any evidence of system mismanagement that was capable in their minds of reasonably displacing the alternative potential explanation of wrongdoing. For that reason I consider that it was within the band of reasonable responses for them to conclude that there was wrongdoing.(g) When the investigating officer completed his investigation report he did [page 190] make some recommendations for improvements at the Trust in light of the claimant’s case. These did touch on training matters [see points 6 and 8 page 190]. I find that it was reasonable for the respondent to proceed with the investigation notwithstanding those recommendations. This is because the conclusions of the investigating officer did not exonerate the claimant (see at paragraph 36(a), (b) and (f) above). If find that it was reasonable for the respondent to take the view that the balance of the investigation report, taking into account points for and against holistically, justified proceeding. The respondent’s case is that the complainant at no stage thereafter ever provided any reasons to explain how his actions were appropriate. I agree.[67]Lack of balanced investigation among employees:(a) The suggestion in the claimant’s witness statement was that although Ana Silva’s complaint did not target anybody by name, no other employees were investigated in the sense that the actions and access logs of the other IT support staff in SWLP IT who had the same access levels were not reviewed. I do not accept this. It is in my judgment factually incorrect on the evidence. The evidence in the bundle, repeated by the evidence of Mr Jaffer at the Tribunal, is clear that the trail of the audit logs showed activity by the claimant on a scale that was not replicated by any other of the SWLP IT staff. The evidence at pages 105 to 109 pointed to a potential for disproportionate activity by the claimant on Ana Silva’s account, in contrast to activity by Richard Coleman on a far smaller scale on that account. Imraan Nazir did not appear anywhere in the log at pages 105 to 109. The evidence at pages 110 to 117 pointed to a lack of evidence to corroborate the disproportionate activity by the claimant. The evidence at pages 118 to 123 demonstrates that the respondent did investigate the activity of other members of SWLP IT staff in connection with WinPath as revealed through HEAT tickets raised, including activity of Richard Coleman and Imraan Nazir. Mr Jaffer at the Tribunal hearing explained the entries relating to other staff in the pages between 118 to 123, which in the appeal bundle appear in highlight. He explained that the highlighting indicated that the respondent had investigated these and had established that legitimate explanations were found for the activity of those other staff members. In all these circumstances, in my judgment it was reasonable for the respondent to carry forwards the investigation against the claimant on the basis of the evidence it had collected. I cannot therefore accept the claimant’s contention that the investigation lacked balance vis a vis other employees.(b) The evidence between pages 105 and 123 revealed Richard Coleman and Imraan Nazir as the only possible other people who could be in scope for investigation. As described by Mr Jaffer (see (a) immediately above), Mr Nazir (who had not appeared at all on the remote access logs) was then excluded. Richard Coleman was investigated and in his investigation interview was asked “what would have prompted you to change [Ana Sofia’s] password without first raising a HEAT ticket?”. True it is, that he was not asked to explain the activity on page 222, nor the instances of his IP address between pages 105 to 109. However, his IP address appeared only twice on pages 105-109 as opposed to the claimant’s IP address appearing over 80 times. In relation to the activity on page 222, the appearance of his IP address was, so far as relevant, just on a single time to unlock Ana Sofia’s account on 20 September 2023 after the claimant had locked it in the late afternoon before. Richard Coleman’s name did appear on that document 8 other times, but those entries are in relation to a time frame and subject matter that has never been in dispute. In my judgment it was therefore reasonable for the respondent not to pursue an investigation against either Richard Coleman or Imraan Nazir.(c) The chronology I have set out above demonstrates that the claimant’s allegations of pre-determination and lack of impartiality started immediately after his suspension, and well before the investigation had even progressed to the writing of Terms of Reference. In contrast, as the respondent’s representative put it at the Tribunal in closing argument, the allegations against the claimant involved “a number of people looking, and “went through a number of pairs of eyes”. I agree. As I have said above, the activities of the claimant in the log at page 222 formed an unbroken chain that connected the fact finding, the investigation, the disciplinary interview and the content of the dismissal letter (the links in that chain being paragraphs 22, 23, 25, 28, 29, 38 and 39 above). This same content was, therefore, reviewed by a number of different people who were independent of each other. For those reasons, I cannot accept the claimant’s contention that the investigation lacked impartiality.[68]Failure to disclose evidence:(a) The claimant’s witness statement alleges that during the investigation and disciplinary process the claimant requested “various documentation” and that this “included” documentation showing access by other SWLP IT staff to WinPath logs and records of password changes.(b) On 13 March 2024 the claimant asked [page 143] Mr Jaffer by email for “a proper audit” as opposed to the screenshot [page 170] that he had been shown. On 18 March 2024 he said “no evidence had been shared” with him. On 15 April 2024 the investigating officer Robert Akutu sent the claimant [page 167] the document at page 164 and, it appears to me, what must have been the document between pages 105- 108 in addition to the page 170 screenshot. Then, throughout the whole proceedings there was a back and forth relating to the document at page 222. This was provided to him initially with the activity of Richard Coleman redacted out and then provided without those redactions shortly before the disciplinary interview. The claimant’s case has always been that the document at page 222 as it still appears now is not the same document that was showed to him at the initial fact-finding meeting of 06 March 2024. In re-examination at the Tribunal hearing, he said the document that he was shown on 06 March 2024 contained “a lot more” than is provided in the final hearing bundle, and that it spanned a full 12 months and showed the names of both Richard Coleman and Imraan Nazir. He referred to page 206 where he had requested this and page 207 where Mr Osgun had stated “This request is not relevant. Audit pertaining your [sic] activity is included in the report”. He pointed to page 491 where there appears a page of a hard copy notepad with handwriting on it detailing 5 points, number 5 saying “on 29-12-2023 Richard locked Sofias [sic] account”.(c) The claimant’s case as to the document at page 222 is essentially that the respondent deliberately withheld information that could have exonerated him. He is, effectively, here alleging deliberate bad faith on the part of the respondent. The respondent’s case is that nothing more than the document at page 222 ever existed and that, even if an argument could be made that it should have been showed unredacted to the claimant at an early stage, this was not sufficiently material to compromise the fairness of the whole process because (i) it contained nothing that would have assisted the claimant and (ii) in any event it was shown unredacted to him before the disciplinary hearing which was both at a time when he was able to comment fully on it and at a time before the decision to dismiss was taken. I prefer the respondent’s submissions on this point for the following reasons. Firstly, I have found as per paragraphs 67(a) and (b) above that the respondent, acting reasonably, excluded Richard Coleman and Imraan Nazir from the investigation at an early stage because no evidence pointed to them. Secondly, although page 207 does contain an assertion that parts of the log were “not relevant”, those parts that the respondent was referring to as “not relevant” (namely the parts blacked out at page 164) were in my judgment shown to the claimant at a stage where any previous deficiency was corrected at an early enough time. Thirdly, even if a log shown to the claimant on 06 March 2024 had spanned 12 months precisely to the day, the first part of that time frame which page 222 does not cover would be before 25 January 2023 which is at a time out of scope of even the originating complaint by Ana Sofia. In this regard it may be helpful to point out that it can be seen from page 222 that the document has a row at the bottom of the page which is illegible because only partially printed, leading to a reasonable belief that more rows followed below which have not been disclosed, but that such a partial print does not appear at the top of the document which relates to 29 December 2023 which the claimant says is the date particularly in issue. It is therefore in my judgment reasonable to assume that the entries for 29 December 2023 are complete whereas the entries for 25 January 2023 are not complete. Fourthly and critically as to the entries for 29 December 2023, there is no evidence whatsoever of bad faith that I have seen in the final hearing bundle and the evidence of the respondent taken in its totality including documentary evidence and oral evidence at the Tribunal hearing is cogent and consistent to a degree where I find that the claimant’s accusation of bad faith is on the balance of probabilities unlikely to be correct. I accept that a suggestion to the contrary appears at page 491 and that the claimant seeks to rely on this. But in the absence of clear corroborating evidence and in consideration of all the evidence in its totality, I do not accept point 5 of page 491, in isolation and on its own, as the truth of what it says. It is possible for example, that the recollection of the claimant now and at the time he wrote that note was incorrect, and on the balance of probabilities and for the reasons given in this paragraph I find that accordingly.(d) The reference to what other documents were sought as part of the “various documentation” referred to in the claimant’s witness statement is not clear in the pleadings and there are no specific requests in the final hearing bundle that clearly request other documents. However, from the claimant’s cross-examination and his representative’s closing submissions it became clear what these might be. What, it is said, should have been obtained and disclosed to the claimant during the investigation were (i) remote access logs showing access by IT staff other than the claimant to the micro-office computer that Ana Sofia’s used and (ii) a record of which lab staff were logged into that “generic office” desktop (as shown at page 109) during the time that inappropriate access was alleged as against him. It is said that the lack of provision of these frustrated the claimant’s ability to defend himself to an extent that rendered the investigation and the respondent’s dismissal decision unfair because it did not allow him to (i) disprove that his remote access to Ana Sofia’s account was disproportionate in comparison with other users by cross-referencing them against the entries at pages 105-109 and (ii) prove that some or all of the remote access attempts as alleged on pages 105-109 were genuine by cross-checking against his own records. I find that it was reasonable for the respondent not to seek those additional documents for the following reasons. Firstly, it was the evidence of the respondent that remote access records were sought for the periods of 30 March 2023 when Ana Silva was not on duty, then 20 September 2023 to 06 January 2024 corresponding to the periods that Ana Silva had reported [pages 124-126] as being particularly problematic. Secondly, it was not apparent from any evidence in the final hearing bundle and any evidence at the Tribunal hearing, that any staff member was excluded from the search parameters that resulted in the page 105-109 print. From this and from pages 110 to 123 all other staff apart from Richard Coleman were, in my view reasonably, excluded. Thirdly, I cannot see that logon material in relation to the “micro office” computer could reasonably have added anything because if the computer Ana Silva used was a “micro office” used by all lab staff as a shared electronic desktop (namely, there and open for use all the time without the need for logging in) as opposed to a shared computer (namely, to be logged into afresh each time a person used it) there would be no differentiation by reference to login data to the external RDWEB gateway and therefore nothing that the claimant could have used by way of correlative data. This, it appears to me, was why the respondent went on to obtain local WinPath activity for Ana Sofia. Moreover, the desktop shown at page 109 appears to have files on it (for example one named “7.3 Ana Sofia Silva”) which seem to be personalised to Ana Silva, which aligns with the respondent’s evidence that this “micro office” was used primarily if not only by her as the senior scientist. Fourthly, I do not find the suggestion that the claimant was denied the opportunity to prove he was connecting for a good reason or not connecting at all to be credible in light of the fact that the claimant refused to provide at any stage any evidence that the account locking was necessary or that there was any legitimate reason to assist Ana Silva with IT support at such unusual and prolonged times as the respondent’s evidence indicated. Fifthly, I can see no reason why the claimant was prevented, on the information that was disclosed to him, from searching his own mobile telephone records to identify instances where Ana Sofia had contacted him outside of the HEAT ticket system, then correlated that to the information at pages 105-109 and 222. I find that it was reasonable for the respondent to rely on the fact that he singularly and consistently failed to do so. For all these reasons, I find it was within the band of reasonable responses for the respondent not to seek these additional documents.[69]Disciplinary process not followed correctly in terms of the claimant’s suspension and disproportionately wrongful reliance on lack of HEAT tickets:(a) The claimant’s witness statement alleged that instead of suspending him the respondent should have re-deployed him to a different department. In this regard he prays in aid the reference at page 484 dated 02 April 2024 (appearing to be a mobile phone record) from Elizabeth Olagbaju saying “it has come to our attention that the suspension process was not followed completely”. In closing submissions his representative added that the consequence of suspension was denial of access to records that might have helped the claimant prepare his defence and hence avoid a formal investigation. Allied to this is the claimant’s representative’s closing submission that the checklist at page 437 of the bundle in the respondent’s disciplinary policy was not followed. The respondent’s case is that even if the suspension process was not followed to the letter, the Tribunal cannot interfere if dismissal was appropriate after a reasonable investigation based on reasonable grounds.(b) Referring to page 163, Mr Jaffer wrote at paragraph 9 of his witness statement that “it was agreed with Simon Brewer (Managing Director at SWLP) in line with the Respondent’s disciplinary policy (section 8) [428], that the Claimant should be suspended due to his activity on Ana’s account [128-130 and 163]. At the time of suspending the Claimant HR were unavailable but Simon Brewer had confirmed his agreement to suspend the Claimant in order to protect patients, staff and services within the Trust to ensure that the investigation would not be impacted (such as the risk of evidence being deleted”. The same evidence was given orally at the Tribunal hearing. At page 128 in the letter of suspension Mr Jaffer wrote “Please note that a disciplinary pre-investigation checklist will be completed as part of this process and an independent panel within the Trust will review the information provided and make a decision on how the matter progresses”. The Trust’s disciplinary policy states [page 426] that an “initial review” to “establish/clarify information to determine how to proceed” must be “completed with 7 days”. The policy mandates consideration of temporary protective measures but says at its paragraph 8.2 as follows: “As a last resort, where alternative arrangements have been considered and are clearly insufficient, an individual may be suspended where it is necessary to:• Protect patients, or staff or the Trust’s services; and/or• Ensure that the investigation can proceed quickly and is not hindered”. The pre-investigation checklist at pages 437 and 438 ends with suspension at the last page. I find as a fact that if Mr Jaffer did not complete the pre-investigation checklist until after he suspended the claimant, that was a technical breach of the disciplinary policy. However, I also find as a fact that the referral to Mr Brewer was in accordance with paragraph 8.2 of the disciplinary policy. I therefore find that the defect in the suspension, if there was one, was not sufficiently material to put the fact-finding, investigation and disciplinary process, taken in its totality, outside of the band of reasonable responses in Burchell terms. Likewise, I find that the respondent’s decision not to re-deploy the claimant as an alternative to suspension was not unreasonable in Burchell terms in light of the overall detrimental effect that the respondent reasonably believed the claimant’s activity to have caused.(c) As to the argument that the suspension prevented the claimant from access to records that might have helped the claimant prepare his defence and hence avoid a formal investigation, I do not agree. I find that the claimant at all times had the opportunity to explain his actions and to provide his own corroborative evidence from his own mobile telephone records but failed to do so. For this reason, allied with my finding it was reasonable for the respondent to proceed with the investigation on the evidence that it had, I find that the inability to grant the claimant access to internal records during the investigation was not unreasonable in Burchell terms.(d) The point about reliance on HEAT tickets was repeated by the claimant’s representative in closing submissions. He developed the point like this: other users aside from Ana Silva had problems, the investigation dismissed the possibility of the bug and focused wrongly on the claimant’s 2 occasions of activity for periods when Ana Silva would be unlikely to be accessing her computer and in any event for which the claimant says he was providing IT support even if out of hours, for which there is prima facie evidence identified at pages 124 and 126. I disagree. The respondent’s investigation was in my judgment not based unduly heavily on the absence of HEAT tickets. That was part of the evidence against the claimant but not the totality of the evidence. The other evidence available to the respondent was the access logs, the activity at page 222 and the evidence that no other IT staff member had locked accounts. Taking all this evidence together in totality and having reasonably excluded other staff members from the investigation, in my opinion it was reasonable for the respondent to conclude in totality that, given that the claimant could offer no reasonable explanation or evidence of his own to the contrary, he had gained irregular and unauthorised access and performed unnecessary and irregular actions.[70]Harsh and unjust sanction: I do not agree that it was unreasonable for the respondent to dismiss the claimant as opposed to transferring him to another department. This is because I am satisfied (see below) that the respondent genuinely believed that the claimant had committed gross misconduct in breach of the specific terms of the disciplinary policy cited in the dismissal letter. The claimant’s witness statement also suggests that the respondent, in arriving at its choice of sanction, failed to properly consider the claimant’s explanations during the investigation. I do not agree. The claimant’s explanations in sum total were that any activity or access he had to Ana Silva’s account was authorised in the course of standard IT support. The respondent’s conclusion was in my judgment transparently and reasonably that the claimant’s explanation did not hold true.[71]Having dealt above with the claimant’s grounds of challenge as set out in his witness statement and those as they were developed during the Tribunal hearing, I conclude by addressing the wider points that the claimant’s representative addressed in his closing submissions, including as set out in paragraph 13 above.[72]The claimant’s representative’s short point was, I quote, that “where the respondent has gone wrong in this case” was “that they did not look into and investigate the reason that they ended up dismissing him for”. He developed this in various ways, on the one hand arguing for deficiencies in the investigation process and on the other hand arguing that the specific elements of the disciplinary policy relied upon as reasons for the dismissal (see page 435 elements (g) and (y) of clause 3.2 of section 2 of the Trust’s disciplinary policy) were not made out.[73]Aspect 1 at paragraph 72 above – alleged deficiencies in the investigation process:(a) The argument was that there was a problem identified, namely access to the WinPad application, and that the respondent did not properly investigate that. One aspect of this alleged was failure to investigate how the possibility of a computer bug could have been the cause of the misconduct of which the claimant was accused. I have dealt with this above and for the reasons already given above I disagree with that proposition.(b) Further, the argument was that the respondent failed to present the page 222 interactions to Ana Silva and ask her whether each of those was genuine and whether they were done without her authority. The background to the argument was that, based on the way Ana Silva had initially reported the problem namely with no individual named by her and the background of the known bug, the respondent should not have been surprised to see a number of password-reset actions in the logs which were nothing sinister. The argument was that, whilst at page 126 Ana Silva had said she had not asked the claimant to lock her computer, the locking was not the aspect that the respondent should have focused on because that was not the problem that she was experiencing (she was on the contrary experiencing the different problem of system access because of password failure). I disagree. The two are entwined because it is clear from the cogent oral evidence of the respondent during the Tribunal hearing that a manual locking of the account would prevent Ana Silva obtaining access to WinPad. The log on page 222 shows that, even if there was a genuine password reset request on 12 September 2023 at 17:52 and the claimant locked it for that legitimate purpose, the account was not unlocked by him again until 23:03 many hours after the password reset had been completed. Page 222 also shows that on 19 September 2023 the account was locked at 16:23 by the claimant and was not unlocked until 10:39 the next day by Richard Coleman, whereupon it was locked by the claimant on that next day and not unlocked by him until almost an hour later. All of this contradicted the claimant’s evidence at page 226 that “there is a small window when I locked her account, to solve an issue, whilst investigation”. The report by Ana Silva on page 126 referred to the situation being “critical” when raised to SWLP IT which we know from pages 124 to 125 to be on 20 September, which arguably is demonstrated on page 222. For these reasons and due to my findings in relation to the bug, and then in the context of the claimant’s inability to provide an explanation on 06 March 2024, it was in my judgment within the band of reasonable responses for the respondent not to take Ana Silva through the contents of page 222. Given her general description of the problem and the evidence they possessed on page 222, I find that it would have been otiose for them to take Ana Sofia through all the logs at page 105- 109.(c) The next point was that it was not reasonable for the respondent to assume that Ana Silva was locked out because of the actions of the claimant. This was predicated on an observation that outside of page 222 we have no other document that shows that at the time she was complaining of being locked out, she was locked out by the claimant, in tandem with the argument that the background (computer bug) showed that accounts were being automatically locked. I have dealt with and rejected the computer bug aspect above. But the other aspect argued was that the logs at page 105-109 do not match the times at page 222 therefore the evidence did not prove that the claimant was the culprit. The respondent gave cogent evidence at the Tribunal hearing that the unusual number of logs at pages 105-109 gave it cause to extract the data at page 222 at the application (not the RDWEB) level, and that the logs at pages 105-109 did not need to match the logs at page 222 because the former represented what could be fleeting access with no activity to change the account, whereas the latter represented changes to the account. For that reason and for the reasons in (b) immediately above, I find that the respondent had sufficient evidence reasonably to infer that there was an irregularity attributable to the claimant unless another explanation could be provided by the claimant.(d) The next point was that Mr Jaffer did not take the log at pages 105-109 to the claimant and ask him to look at and comment on all the connections. The claimant was provided with that log before the disciplinary meeting but the point argued was that it was unfair for the investigation even to start without the claimant having been given that opportunity because there was an unwarranted assumption of guilt from the start that was in the mind of Mr Jaffer immutable, which then coloured all events thereafter. I disagree. I find that, taking all the evidence together that Mr Jaffer had before him, it was within the band of reasonable responses for him to progress to the next stage of commissioning an investigation. It was then at a later stage open to the claimant to offer alternative evidence from his own telephone records which he failed to do.(e) The overall argument made in relation to aspect 1 was that the claimant’s guilt was wrongly assumed at an early stage and that this wrong assumption was so strong that despite glaring lacunae, it was never realistically going to be deviated from, meaning that it was unfairly pre-judged. This was put to Mr Jaffer in cross-examination at the Tribunal hearing and his response was that at all times he was objectively led by the evidence that he found as opposed to him selectively choosing convenient evidence. For the reasons given in (a) to (d) I disagree with the claimant’s contention and I agree with Mr Jaffer’s evidence. For those reasons I find that the respondent’s actions in the fact-finding exercise, investigation and disciplinary proceedings were within the band of reasonable responses. It was said that Mr Jaffer’s words at paragraph 20 of his witness statement “during my initial fact-finding investigation, the documents that I had collated supported the allegations that the Claimant committed acts of gross misconduct” embody the said closed-minded assumptions argued for. I do not agree. The words “supported the allegations of gross misconduct” were written in hindsight. No specific allegations of gross misconduct were stated until 28 May 2024 in the invitation letter to the disciplinary hearing after the investigation had concluded.(f) In relation to all of (a) to (e) immediately above, the overriding argument made was that the respondent did not have a genuine belief in the claimant’s misconduct because they simply assumed it on the basis of a faulty investigation. I disagree. For all of the reasons given above I find that the respondent did, on the basis of the evidence before it, have a genuine belief that the claimant had obtained unauthorised access to the computer used by Ana Silva and that he had made unauthorised changes to her account. I find that belief to have been reasonably founded based on the evidence that was before the respondent.[74]Aspect 2 at paragraph 72 above - specific elements of the disciplinary policy relied upon as reasons for the dismissal (see page 435 elements (g) and (y) of clause 3.2 of section 2 of the Trust’s disciplinary policy) not made out:(a) The overarching argument made was that the respondent was required to, and failed to, prove that the claimant not only accessed Ana Silva’s computer and changed her password but that in doing so he breached the terms of clause 3.2(g) and (y) of the respondent’s disciplinary policy, in particular (i) unauthorised access to or disclosure of or use of confidential or personal information relating to the business of the Trust and (ii) unauthorised use of any of the Trust’s equipment and/or facilities for private, non-Trust, or improper purposes. The argument was that even if it were shown by the respondent that the claimant had obtained unauthorised access to Ana Silva’s account, it was never shown, or even put to him, that he had seen confidential information belonging to the Trust or its patients. Further, the argument was that the respondent was required, and failed, to prove that the claimant accessed the “micro office” computer at times when Ana Sofia was actually using it, which it is said would be key to establishing breach of the said disciplinary terms.(b) It is true that the allegation of having accessed and seen confidential information whilst accessing the computer used by Ana Silva was never in terms put to the claimant either in the investigation meeting or the disciplinary meeting. However, in the form of Ana Silva’s email to her line manager that caused the inquiry to start, she was clear that as well as the mouse moving there were “documents been [sic] open and closed” not by her. Then in both the fact-finding meeting and the investigation meeting the claimant was showed the screenshot of the IP address 192.168.120.73 that Ana Silva had “caught” on 5 January. Evidence given by Mr Osgun at the Tribunal hearing was that behind the screen shot at page 170 there are visible tabs that can be opened what would contain confidential patient data. I find that it was within the band of reasonable responses for the respondent to assume, on the basis of that evidence, that the claimant did have unauthorised access to confidential Trust data. I find that it was not necessary for the respondent to put that allegation to the claimant specifically. The allegations of unauthorised access were at all times put to him and in my judgment that suffices to bring any assumption of access to such data within the band of reasonable responses. As to the point about use of the “micro office” I find it was within the band of reasonable responses for the respondent to assume on the strength of the evidence of Ana Silva, taken together with the logs and the screen shot, and their knowledge that she was the main if not only user of the computer, that the claimant had access to it at the time she was using it.(c) It was argued that the respondent had to prove by way of breach of the relevant disciplinary policy term, that the claimant not only might have accessed confidential information, but that his explicit purpose in accessing her computer was to access that confidential information. It was argued that to fail to do so would be to allege breach without showing the cause for breach, which would then mean that there was no genuine belief in the breach. I do not agree. In my judgment it was sufficient for the respondent to show, on the strength of reasonably founding evidence that the claimant was likely to have accessed such confidential information. I find that the respondent discharged that burden, and that therefore their belief in the claimant’s breach was genuine.(d) Finally, in closing submissions this was said in relation to proving breach: “It is essential to identify when he obtained access, what he did and whether what he did was within the remit of his responsibilities or not”. The argument was that those aspects were not proven. I disagree. In my judgment, all those aspects were shown to a reasonable standard following a reasonable investigation. I find that, those having been shown to a reasonable standard, the reasons for dismissal reasonably open to the respondent on evidence reasonably obtained in a reasonable investigation were (i) that the claimant had obtained unauthorised access to the “micro lab” computer when Ana Silva was using it and likely viewed confidential patient information in breach of paragraph 3.2(g) of section 2 of the disciplinary policy and (ii) that he had used that computer in that way for purposes which were outside of his remit in connection with IT support and consequently “improper” in breach of paragraph 3.2(y) of section 2 of that policy.[75]The final point made as to the overarching argument that the respondent “went wrong because they did not look into and investigate reason they ended up dismissing him for” related to what the claimant’s representative said were shifting grounds throughout the investigation. He described this as a “moving feast” starting with the representative’s allegations of unauthorised access to Ana Sofia’s computer, moving through questions of locking and unlocking, then ending at use for non-Trust purposes. I do not accept this. My chronology of events above shows that the basic elements of what the claimant was investigated for throughout the whole process remained the specific allegations of(a) unauthorised remote access of a highly irregular frequency and(b) inappropriate and unauthorised account changes outside of legitimate IT support as set out in the page 222 document. These were the constant features in all of the following: (i) the fact finding meeting, (ii) the Terms of Reference, (iii) the investigation meeting, (iv) the investigation report, (v) the invitation to the disciplinary meeting, (v) the disciplinary meeting and (vi) the reasons for dismissal in the disciplinary outcome letter. This is what I referred to above as the “unbroken chain” that linked and formed the foundation for all the stages of the preliminary fact-finding, the investigation and the disciplinary proceedings. Discussion and conclusions – wrongful dismissal[76]The respondent’s closing submission was that it had proven on the balance of probabilities that the claimant had committed gross misconduct, therefore it dismissed him summarily, meaning that he was not entitled to any notice pay at all. The parties agree however, that the claimant was paid 6 weeks’ notice pay. The evidence of Mr Osgun was that this was the decision of HR, not his decision. The respondent says that this was an act of generosity based on the claimant’s individual personal circumstances and that such an act of generosity should not be held against it.[77]The claimant’s submission was that the respondent’s submission was wrong in law because as a matter of fact he was not dismissed summarily but instead expressly told that his employment end date was 6 August, meaning that he remained in employment for 6 weeks after the date of the letter of dismissal. He submitted that, as a matter of law, an innocent party is not obliged to exercise the right to terminate employment summarily even if they have the right to do so following a fundamental breach of contract by an employee, because having a right is not the same as exercising a right. He says that, in this case, the respondent unequivocally elected not to terminate the claimant’s contract summarily but instead to terminate it on notice, meaning that they elected to continue the contract after having reached the dismissal decision, thus are obliged to obey their continuing obligations under the contract.[78]I prefer the claimant’s submissions on wrongful dismissal. As a matter of law, I agree with him that an innocent party is not obliged to exercise the right to terminate employment summarily even if they have that right following a fundamental breach of contract by an employee, because having a right is not the same as exercising a right.[79]At clause 19 the claimant’s contract of employment gave notice periods and said “This does not affect the right or either party to terminate the contract without notice by reasons of conduct of the other party. In the case of the Trust this means that the Trust has the right to take appropriate action, including summary dismissal without the obligation to give notice in the case of gross misconduct or gross neglect of duty”. The dismissal letter received by the claimant (not in the final hearing bundle but supplied at the hearing) stated in terms that the claimant’s actions had amounted to gross misconduct and stated also in terms that gross misconduct was the reason for the respondent’s decision to terminate his contract of employment. I find that gross misconduct was a breach of a fundamental term of the contract by the claimant and that, accordingly, in exercise of clause 19 of the contract the respondent would have had the right to dismiss him without notice. But I find that did not happen as a matter of fact. The dismissal letter stated in terms “You are entitled [my emphasis] to 6 weeks full pay notice period from 25 June 2024”. This is to be contrasted with the initial draft of the dismissal letter [page 244] which stated, “I’ve decided to dismiss you with immediate effect [my emphasis]” and said nothing about any notice at all. I find that, with the conduct of giving 6 weeks’ notice and with the language “entitled to” in the dismissal letter, the respondent waived its right to dismiss the claimant summarily with immediate effect and instead elected to continue the contract with notice to terminate it 6 weeks later. Even if the respondent is right that the reason for that election was an act of mercy to cater for the claimant’s individual circumstances of hardship, goodwill as a reason for the election does not change the fact of the election. This means that the normal notice period as set out at clause 19 of the contract applied. It is not disputed that in the case of the claimant, this would have translated into 10 weeks’ notice. The respondent paid the claimant 6 weeks’ notice but should have paid him 10 weeks’ notice. There is therefore a shortfall of 4 weeks’ notice that I order must be paid. In accordance with item 3 of the schedule of loss at page 6 of the supplementary mitigation bundle, this is payment in lieu of notice of £2,305.32 comprising 4 weeks’ pay in lieu of notice at £576.33 gross of tax and national insurance. Approved by: