Uber London Ltd v Transport for London [2020] EW Misc 20 (MagC) (28 September 2020) [2020] EW Misc 20 (MagC)

EWMISC
Uber London Ltd v Transport for London [2020] EW Misc 20 (MagC) (28 September 2020)
[2020] EW Misc 20 (MagC) · 2020-09-28
[1]See also: Conditions REASONS The Appeal This is an appeal brought by Uber London Limited ("ULL") against the decision of Transport for London ("TfL") taken on 25 th November 2019 not to renew its London Private Hire Vehicle ("PHV") operator's licence. The London Taxi Drivers Association ("LTDA") are not a party to the appeal but were joined as an interested party by a previous decision of the Chief Magistrate.[2]ULL is represented by Tim Ward QC leading Ranjit Bhose QC and James McClelland whilst TfL is represented by Marie Demetriou QC leading Tim Johnston. Gerald Gouriet QC and Charles Holland have provided written submissions and a short oral submission. They appear for the LTDA.[3]ULL brings the appeal per s. 3(7)(a) and 25(3) of the Private Hire Vehicles (London) Act 1998. I am invited to conduct a de novo redetermination of ULL's licence application by reference to the same standard that TfL applied when taking the November decision and decide whether ULL is a 'fit and proper person' to hold a licence. The decision must be made in the light of the evidence now before the court.[4]TfL and ULL agree that there are three issues for the Court on this appeal, namely: Is the Court satisfied that ULL is (at the time of the hearing) a fit and proper person to hold a PHV operator's licence, such that a licence should be granted? ("Issue 1"); If the Court is satisfied that ULL is a fit and proper person to hold a PHV operator's licence, should that licence be subject to any conditions and, if so, what conditions? ("Issue 2"); and If the Court is satisfied that ULL is a fit and proper person to hold a PHV operator's licence, for what duration should any such licence be granted? ("Issue 3")[5]TfL are the regulatory body who have an abundance of experience in this area. Parliament has given them the statutory responsibility of granting PHV licences. I give due weight to their findings, analysis and their ultimate decision though it is for this court to come to its own assessment on the evidence as it now stands.[6]ULL has presented no real challenge to the facts as presented by TfL though has challenged the suggestion that breaches were not taken seriously and any suggestion of bad faith on their part. Their approach has really been to explain why events took place as they did. In particular, Ms Chapman was not cross-examined and her evidence therefore was left unchallenged. Relevant History 31.05.2012 ULL granted licence for 5 years 22.09.2017 TfL refuses to renew the licence 26.06.2018 Chief Magistrate allows ULL appeal and grants 15 month licence 03.07.2019 ULL applies to renew licence 24.09.2019 TfL grants ULL a 2 month licence as 'unable to resolve 2 questions' 25.11.2019 TfL refuses to renew licence, 'the November decision' Parties' Positions[8]TfL say that their November decision was correct. Uber did not advance any contrary argument. Indeed, Mr Ward, in closing, stated ' There is just no purpose in a debate before the court about whether the decision, frozen in time, in November 2019 was right on the material available at that time. It is common ground that the law requires a different test to be met which is whether the decision is now wrong!"[9]In relation to the above key question which must be decided by reference to the situation now, TfL's position can be summarised as follows: i. TfL's Decision was correct: ULL was not fit and proper to hold a licence in November 2019. ii. Some of the matters that informed that decision have been addressed in the intervening 10 months. iii. Insofar as the concerns regarding systems, processes or operations have subsequently been dealt with, the court will need to determine whether it has sufficient confidence that ULL no longer poses a risk to public safety. The court must also weigh the further matters of concern that have arisen since November 2019. iv. They remind the court that 'past misconduct by the licence holder will in every case be a relevant consideration to take into account when considering whether to cancel a licence." v. TfL, at the appeal hearing seek to assist the court including 'by testing some of Uber's evidence and identifying some of the key themes in the evidence that the court should take into account." vi. Ultimately, they say that in relation to changes, 'it is relatively early days and ... more time is required to be confident that these interventions have sufficiently embedded." (per evidence of Ms Chapman)[10]ULL argue that since the refusal to renew the licence: i. ULL has taken action and addressed the concerns raised. ii. ULL's response to the refusal evidences that they are a fit and proper person. iii. That there is a substantial body of evidence which supports a finding that they are a fit and proper person. This includes evidence identified by TfL themselves. iv. On the evidence now before the court, the court can be satisfied that ULL meets the test of 'fit and proper person.' The Evidence[11]The parties served bundles of statements and exhibits. I heard live evidence from: i. James McPherson Heywood, Regional General Manager for Uber in northern and eastern Europe. ii. Ms Laurel Powers-Freeling, the non-executive Chair of the Board of ULL. iii. Christopher Earl Schildt, Senior Manager, Community Operations Divisions, ULL iv. Ms Helen Chapman, Director of Licensing on behalf of TfL.[12]I observe that TfL did, at that stage, find ULL to be a 'fit and proper person' in granting the 2 month licence on 24 September 2019 though it was for a very short period to allow further investigation to take place as regards two issues. It was then refused.[13]The reasons for TfL's refusal are contained in their decision letter dated 25 November 2019. The key concerns are summarised: i. Regulatory breaches since June 2018 (ie, since the grant of the 15 month licence) ii. Assurance Reports failing to recognise the importance of some of the breaches and that they were insufficient to have confidence in ULL's systems. iii. The Cognizant report commissioned by TfL concluded that ULL's IT Service Management rated below the standard that would be expected of a company in its position, as regards 'Change Management Systems' and 'Release Management'.[14]Since the November decision, TfL has come to learn of additional matters of concern:(i) significant delays by ULL in deactivating three drivers who committed sexual assaults against passengers,(ii) further piecemeal explanations of the root cause of the driver photo fraud issue,(iii) inaccurate and inconsistent data in ULL's Assurance Reports which, in turn, requires further analysis and verification by TfL,(iv) further regulatory breaches as set out in the February 2020 and May 2020 Assurance Reports, and(v) data management issues, particularly a data outage of ULL's systems in April 2020.[15]I propose to deal with this appeal by first exploring what has changed since the November decision and whether relevant concerns and issues remain. a. ULL has addressed the IT Change & Release Management Systems highlighted in the Cognizant Report i. After the Cognizant Report, Uber swiftly implemented changes including additional software tools, implementing compliance review systems, implementing regression testing and policies ensuring prompt escalation to LOMC with additional technical capability. ii. Uber commissioned a report undertaken by KPMG to review the changes (01 April 2020). They concluded: Uber's processes ranked at Level 3 maturity overall with four of the ten assessment areas actually scoring a Level 4 rating and that:
'A maturity scoring of Level 3 and Level 4 across the assessment domains for both Change Management and Release Management demonstrates a level of maturity which is characterised by processes which are standardised, documented, well understood and reinforced through training.'
'The maturity level of the Change Management and Release Management processes have been improved. We would expect the improved controls, including but not limited to increased automation, improved testing processes and increased governance to significantly reduce the likelihood of regulatory breaches caused by Change Management and Release Management.' iii. KPMG updated their Report on 12 June 2020 and stated: all of the improvements had been sustained, the new processes were being consistently followed, and the Level 3 (with Level 4 elements) rating remained valid. iv. PA Consulting were then instructed by TIL to review progress and KPMG's Report and concluded that: ULL's change and release management systems should be assigned a maturity level of Level 3 and that ULL had now addressed the major gaps identified within the Cognizant ITSM assessment. PAC has described a level 3 rating as meaning that the relevant systems are 'fit for purpose in minimising the risk of regulatory breaches.' v. In the words of Ms Chapman 'this gives TfL comfort that ULL has addressed the deficiency in its change and release management process identified by Cognizant" She also states, however, 'in light of the fact that some of the interventions were introduced as recently as March 2020, I think it is fair to say that it is relatively early days and that more time is required to be confident that these interventions have sufficiently embedded." vi. TfL accepts that a Level 3 rating provides it with sufficient confidence that ULL's systems are adequate. b. Continued implementation of Programme Zero to Reduce Regulatory Breaches i. This programme was in fact rolled out in February 2019 and before the refusal of the licence. It seeks to eliminate regulatory breaches altogether, ie to zero. There are 7 strands of work and these are the subject of Board level scrutiny on a monthly basis. Mr Heywood described the practical steps on document compliance, complaints handling, safe and compliant trips, safe change, governance, risk and control and a focus on organisational culture. ii. The evidence is that the number of regulatory breaches has reduced from 55 in Q3 2018 to 4 in Q2 2020. iii. Regulatory breaches such as drivers not being insured with appropriate cover create clear risk to passengers. ULL was convicted of two offences of causing or permitting drivers to use their vehicles without insurance at Westminster Magistrates' Court. c. Specific Steps on invalid insurance / insurance fraud iv. There has clearly been a failure to properly review and validate that drivers have valid insurance documents. v. Prior to the previous appeal before the Chief Magistrate in 2018, ULL was convicted in 2014 for causing or permitting drivers to use their vehicles for hire and reward without insurance. vi. In 2019, ULL were once again convicted of the same offences in relation to 2 drivers. I do however observe that these convictions were known to TfL when they renewed the licence for 2 months in October 2019. The situation is aggravated though, by the fact that a total of 12 drivers have been identified as using their vehicles without the necessary insurance during the period early 2018 to October 2018. The figure is higher than just the 2 that were prosecuted. This resulted in many uninsured trips, 2 uninsured drivers undertaking over 1400 bookings just between them. vii. ULL says it has since addressed the issues, and argued the following: a) Improvement to its electronic and manual processes. b) Its review of all other insurance documents it held for drivers to identify if there were any other failures. c) The close involvement of the Board which directed a number of actions be taken to find out why these failures occurred and to put in place actions to prevent them occurring again. d) That the Board, and ULL as a whole, has committed to zero errors in relation to breaches. e) Investment in resources in eradicating errors, both in the form of new staff and new technological solutions. f) That it had communicated proactively with TIL on this issue and readily shared information with TIL once it emerged. g) Its continued engagement with several insurance companies specialising in taxi and private hire. h) The further extension of ULL's Instadoc system to additional insurance providers, enabling insurance documentation to be submitted directly to Uber by the insurer. viii. Instadoc is an industry first and allows providers to send insurance documentation directly to ULL. It has allowed identification of fraud that had previously gone undetected. Indeed, it has identified previously unknown instances of invalidity or fraud in relation to vehicle insurance. ix. There has also been the issue of 9 drivers being allowed to drive on the App with insurance that had not yet commenced. This was identified in July 2019. Software changes were, however, introduced within 3 hours of identification of the issue to prevent the use of post-dated insurance documents. Fraudulent Documents, Driver Photo Fraud and ULL's Response x. Document fraud including MOTs, driving licences and TIL PHV driver licences all present a challenge. xi. ULL drew TfL's attention to 6 drivers who presented 'modified' insurance documents on 04 February 2019. TIL says the issue was not properly escalated in accordance with normal established routes. On 22 February , ULL referred to those 6 cases and an additional 6 cases. After a meeting with James McPherson Heywood, Regional General Manager and Ms Laurel Powers-Freeling on 11 April, TfL asked for full and frank information and wrote to ULL thereafter. On 02 May, at a further meeting, ULL explained that they had reported 10 of them to Action Fraud or the Metropolitan Police. ULL stated that they had developed more effective controls and that 45 drivers had been dismissed due to fraudulent documents since 01 January 2018. On 09 August 2019, ULL updated that it had identified a further 27 suspicious documents. xii. TfL also had concerns that prior to September 2018, ULL did not suspend a driver pending investigation of a fraudulent document. xiii. ULL explained new steps to combat the use of fraudulent documents: They include: a) Introduction of a secondary review of all documents before they are approved; b) An increase in the number of ongoing assurance checks that are undertaken after document approval; c) Document fraud training that has been developed with the support of the Home Office and the Metropolitan Police Service; d) Availability of reference guides for agents that include examples of official documentation; e) Introduction of a feedback loop to update agent training material as and when new fraud techniques and patterns are identified; f) Extension of the Instadoc system to additional insurance providers, enabling insurance documentation to be submitted directly to Uber by the insurer; g) Enhancements to its document approval system, for example functionality that will flag to an agent when a driver re-submits a document multiple times. On 21 November 2019, they stated they were in discussion with the City of London Police to convene a cross-industry working group to share information and best practice. xiv. I now turn to the issue of Driver Photo Fraud. xv. A single male individual was identified by ULL as having their photo on the profile of a female driver. On 14 November 2018, aPHV105 was sent to TfL notifying them that the driver had been dismissed. xvi. In February 2019, a second case was identified, and discovered to have involved a further individual on 04 March 2019. A fourth case was identified by an Uber agent on 08 March 2019. Mr Heywood accepted that at that stage, they realised 'it was a broader problem than we had originally thought at the time of the first case." PHV105s were sent and the issue raised in the monthly update with TfL in May 2019. Following further investigation, including further audits which were conducted from October 2018 to August 2019, a total of 24 individuals were found to have fraudulently used active Uber driver accounts between August 2018 and January 2019. This involved 14,788 trips. Mr Heywood accepted that this posed a significant risk to passengers. The 23 drivers were dismissed and relevant PHV105s sent to TfL within the 14 day condition. xvii. Mr Heywood stated that 97 to 98% of complaints of wrong driver (ie passengers complaining that the driver did not match the photo on the app) are, in fact, not upheld and are mistakes. The rest can be put down to account sharing. xviii. In October 2019, ULL tightened up their process for responding to wrong driver complaints. xix. TfL expresses real concern on the issue, including whether the concerns were taken seriously, slowness to report the issue of driver photo fraud, the detail in some of the PHV105s, ULL's vulnerability to such fraud and the risk of recurrence and the time it took to uncover the root causes. xx. The issue was addressed by all 3 of ULL's witnesses who gave live evidence. I found all 3 to be credible and honest in the evidence they gave. Mr Heywood's Evidence xxi. Mr Heywood made 3 witness statements and gave live evidence in court, xxii. He explained the difficulty of identifying who the borrowers were (the individuals who had their photos fraudulently on the real drivers accounts). I accept that they did not know who any of the borrowers were till April 2019. xxiii. He insisted that ULL treated it as a safety issue from the very beginning and said it had been codified as such by the investigating agent in Limerick. A fix in the software was implemented and ULL had wrongly thought the issue had been resolved. The PHV105 was sent to TfL. He now accepted that the form was incomplete with no reference to fraud but stated that the systemic vulnerability had not been identified at that stage. He conceded that ULL should have shared more and should have categorised it as a breach of regulations with TfL. They did not, he said because they had not seen anything like it before though he did not seek now to provide a justification. xxiv. In March 2019, he personally became aware of 2 more cases. He accepted he should have been told before. He accepted that the link with the earlier case should have been identified earlier. xxv. He stated that another photo change was identified after it was thought the software fix had resolved the issue. In retrospect, he accepted that notification to TfL in the PHV105 did not adequately notify that there was an ongoing investigation into a vulnerability in the App. xxvi. He accepted that in retrospect that there should have been earlier escalation to senior TfL leadership and clearer information in the PHV105. He added that is not how ULL would deal with the situation now. xxvii. He stated that at the relevant time, ULL was not clear as to which of the channels to use, to report serious safety issues and what to put in Assurance Reports. xxviii. By 23 April 2019, ULL were aware that that either the fix did not work, their audit had not worked or there was further vulnerability in the app. He accepted that the impression they had given to TIL was that the issue had been addressed. That was wrong. xxix. The issue was dealt with in Annex 2 of the 26 June 2019 Assurance Report. He rejected the idea that it had been buried but accepted that they had failed to communicate this problem to TIL in a manner that was appropriate and that drew its seriousness to TfL's attention. He accepted that TIL was right to take into account the failings in communication. They were properly taken into account by TIL in refusing renewal. xxx. He accepted that they had initially failed to understand the root cause of the issue in two versions of the app, thinking it only affected the Carbon app. There had been a failure by the engineering team to exercise proper rigour. The audit that followed was therefore not wide enough in scope and missed 13 drivers. He described it as 'a disaster.' Later audits then uncovered yet further instances. xxxi. There had since been changes, including some as a result of the Cognizant Report. There was further senior-level review of technical analysis before it was provided to LOMC. In particular, the Head of Engineering now personally reviewed any root cause analysis. ULL had also accelerated some work that was planned to include ensuring standards were ISO 27001 compliant. 17 changes were introduced. These had been reviewed by KPMG and PA Consulting and suggested that their systems were now at least to a Level 3 standard. Ms Laurel Powers-Freeling's Evidence xxxii. She made 2 witness statements and gave live evidence in court. xxxiii. She rejected the suggestion of concealment or hiding the issue of driver photo fraud. xxxiv. She confirmed that she had sought improvements to the way information on breaches is presented to the Board. The Board only came to know of the driver photo fraud on 25 March 2019. She accepted it should have been escalated as a regulated breach by then. The issue was a significant safety breach and should, with the benefit of hindsight, have been escalated to the Board back in October. This failure hindered to the ability of the Board to confront the issue. There had been reasons why that did not happen. She suggested that the seriousness was, initially, not fully understood and so ULL did not initially report beyond the PHV105s. xxxv. She conceded that communication with TfL could have been better and clearer and that information that should have been sent had been missing. The significant safety concern had not been highlighted effectively when it ought to have been. The PHV105 notifications were insufficient. She re-iterated her concessions were with the benefit of hindsight. xxxvi. She accepted that the May Monthly Update to TfL gave the impression that the problem had been fixed when investigations were ongoing and it was unknown. xxxvii. She accepted that the fraud raised fundamental risks for passenger safety and was extremely serious. It was something TfL rightly took into account in its considerations. She accepted mistakes had been made in understanding the issue in terms of the cause and the scale. She added they had addressed the issue which transpired to be a vulnerability in the change and release management processes. Cognizant had identified areas of improvement and they had been implemented. xxxviii. She conceded that the Cognizant Report had accelerated the implementation of improvements but added that systems and processes were the subject of constant review in any event. xxxix. She stated that a new non-executive Board member had also been appointed after the said report. He had expertise in IT service management and testing and been a Chief Technology Officer with a FTSE 100 company. xl. She conceded that some changes were reactive to TfL in their role as regulator rather than proactive. She accepted that was relevant to being a 'fit and proper person'. xli. She accepted that there had been failure in internally escalating the fraud issue to the Board. Importantly she recognised the consequence in that the delay had hindered the ability to confront the Board. She accepted that communication with TfL should have been better, clearer and more comprehensive and safety concerns highlighted more effectively. She agreed that there made been mistakes on ULL's initial understanding of the cause and scale of the driver photo fraud. Analysis[16]Dealing first with fraud and insurance, in submissions, TfL states:
' TfL considers that this second breach of the criminal law in relation to insurance is significant and provides a strong indicator that ULL is not a fit and proper person to hold a PHV operator's licence. The provision of uninsured PHV services is a matter of the utmost seriousness to TfL: it exposes the public to an unacceptable risk and places their safety in peril.'
[17].I note that ULL has 45,000 drivers. They singularly provide millions of trips each month in London to 3 million Londoners. It might be said that the number of identified cases is low. That may well be so, but operating a business model of that scale brings greater risk and requires enhanced systems and processes which can properly mitigate the risks to public safety.[18].I note the conviction. I also note the failure to identify the other drivers who did not have appropriate insurance cover but I also note ULL's response by way of their industry leading software and enhanced manual checks. They suspend and notify TfL promptly once there is suspicion of fraud on the part of a driver.[19]The steps and actions taken by ULL in relation to fraudulent documents are according to TfL, themselves, recognised by the insurance sector as being sophisticated and thorough.[20]As regards sharing information and best practice on insurance fraud, TfL describes how 'the steps taken by ULL in this area have also been recognised by the insurance sector as being sophisticated and thorough." On the subject TfL accepts 'In conclusion, the number of cases in which fraudulent insurance certificates or other documents have been accepted has fallen and the steps taken by ULL has taken in this regard are recognised. Nonetheless recent breaches by ULL in this area were serious. This posed a significant and unacceptable risk to passenger safety .'(para 92 submissions)[21]The commission of a criminal offence by any company is serious indeed. TfL are right to highlight it as a consideration. I note, however, that they did not refuse renewal on that basis in October 2019. In relation to fraudulent documents more generally, TfL were also quite right to right to express concerns that drivers with fraudulent documents were being allowed to continue to drive for Uber whilst they were investigated.[22].I do, however, consider the clear failings in context and also consider the company's responses to the issues. I note the involvement of the Board which has a critical role as a check on the operations of the company. They did exactly what I would expect from them; direct that the cause be identified and accordingly, implement measures to remedy the situation. In September 2018, they directed that drivers suspected of fraud should be immediately suspended. I have to say that the interventions of the Board have been critical in my decision.[23]On the evidence, ULL now seem to be at the forefront of tackling an industry wide challenge. ULL has failed to identify fraud but has, thereafter, implemented extensive measures which have reduced incidents. For example, documents are now manually reviewed a minimum of 4 times (5 for insurance documents) and up to 6 times. There has been training and experienced agents deployed in the evaluation of documents. I am satisfied that this is a significant tightening up of the process and addresses the challenges of human error. Mr Heywood added they would seek to identify further improvements.[24]On a separate note, TfL were also quite right to right to express concerns that drivers with fraudulent documents were being allowed to continue to drive for Uber whilst they were investigated. That position has been reversed.[25]I recognise that fraudulent documents and the increasing level of sophistication in fraud is a real challenge both in this and other sectors. Staying one step in front of the fraudsters presents a challenge in all walks of life.[26]ULL does not have a perfect record but it has been an improving picture. The test as to whether ULL are a 'fit and proper person' does not require perfection. I am satisfied that they are doing what a reasonable business in their sector could be expected to do, perhaps even more.[27]Another concern that was raised was related to post-dated insurance issue. In their decision letter, TfL stated "TfL recognises that ULL took immediate action to address this issue and has prevented this from happening again." I share TfL's view on the point.[28]Whilst prompt rectification does not excuse gaps that existed at the relevant time, I am satisfied that the issue was dealt with very promptly.[29].I next deal with the driver photo fraud issue. I have dealt with the evidence in some detail. I am grateful to Mr Gouriet for his submissions on behalf of LTDA. They suggest there has been 'a cover up' on the issue. The flaw in the apps allowed completely unknown individuals to drive passengers around in London. Any finding of bad faith or an intentional attempt to mislead a regulator would be a serious matter.[30].I have carefully considered the evidence in the context of what he argues. I do not, however, agree with his interpretation and do not draw the inference that the evidence suggests attempted concealment.[31]That said, I do find mishandling of the issue by ULL. Mr Heywood struck me as frank and honest in his evidence and accepted failings. Initially, ULL, failed to correctly identify the root cause of the problem. They did not swiftly link subsequent cases to the first. A subsequent audit was undertaken which Mr Heywood described as a 'disaster'. A further audit then identified another case. Communication with TfL was inadequate. Forms were incomplete and TfL given the wrong impression as to ULL having resolved the issue. I find this was misplaced optimism rather than an attempt to mislead. It took far too long to resolve. In the event, 4 audits identified the 24 drivers. I do accept that they did not know who any of the borrowers were till April 2019.[32]Mr Heywood frankly conceded that, in hindsight, ULL had underestimated the issue. I found him clearly reflective on the failures.[33]Ms Powers-Freeling also presented as an honest and credible witness. She accepted that there had been failure in internally escalating the fraud issue to the Board. Significantly, she recognised the impact of that delay which had hindered the Board in confronting the issue. She accepted that communication with TfL should have been better, clearer and more comprehensive and safety concerns highlighted more effectively.[34]I find there was a lack of clarity on ULL's part as to how to deal with the matter and a failure to best present the issue. Internal failures compounded uncertainty and confusion. I do not, however, find that their manner of reporting was motivated by an attempt to hide or conceal.[35]Ms Powers-Freeling agreed that there made been mistakes in ULL's initial understanding of the cause and scale of the driver photo fraud. She conceded that some changes were accelerated by TfL's commissioning of the Cognizant Report and reactive to TfL in their role as regulator rather than proactive. She accepted that this was relevant to being a 'fit and proper person.'[36]I find ULL to be both pro-active and re-active. Whilst the ideal model of business would be the former, learning and change will inevitably be impacted by issues as they arise. The evidence does not suggest that positive change has been only driven in response to crisis or demands from TfL.[37]Insight is critical to change and a critical attribute of a 'fit and proper person'. I am satisfied that both Ms Powers-Freeling and Mr Heywood showed real insight into the failings and evidenced to me the clear changes that ULL has now implemented. That said, insight alone is not enough. Whilst there may be concerns as to the possibility of over stating a problematic issue, minimising an issue is a greater evil.[38]Mr Heywood holds a key position within the organisation and along with the Board, is central to defining the culture and what its values are. I was comforted to hear reference to the significance of the culture in an organisation in addition to systems and process. He said, 'that processes and controls are only good as the organisation that substantiates it and specifically the culture of the organisation on which those controls run." He talked of prioritising safety culture and, at an operational level, he said 'you can tell the teams care about safety." That said, words alone are not enough.[39]I have considered what KPMG and PA Consulting say about the systems and processes that have been put in place since TfL's refusal. They both confirm that ULL has plugged the gaps identified that led to failures. PA Consulting concluded that the changes have become 'business as usual processes." There has been no challenge to their conclusions, and I agree with them. I find that ULL has, thereby, responded to a concern of Ms Chapman and now addressed the root causes of the breaches.[40]I now deal with concerns that have come to light since the refusal.[41]Three drivers' accounts were not de-activated at the time of serious incidents (sexual misconduct, in 2016/2017). That was due to a manual or human error by ULL. This only came to light in November or December 2019 by an audit and not at the time. A retrospective identification through audit is clearly not acceptable. Mr Heywood accepted that they continued to drive after the complaints and described this as 'alarming.' Concern is raised as to the use of multiple tools including Bliss and lira. I am satisfied that changes since the said audit have addressed the legitimate concern raised by Ms Chapman. Mr Schildt, in his evidence, described a new tool which is also being rolled out to deal with the issue. He added that he did not think that tool was necessary as the safety gap had already been closed by 5 key changes that he described. I agree with him and am satisfied that changes sufficiently deal with the concerns raised.[42]Seven drivers were able to continue driving after their MOTs had expired. I note, however, this breach was for only one hour. ULL says it became aware of a software issue in January 2020 and that a fix was implemented in February. I am satisfied that the matter was resolved quickly and presented a relatively narrow risk. Whilst I note Ms Chapman's continuing concerns, I must also assess the evidence given by KPMG and TfL' s own assessment conducted by PA Consulting which gives comfort that issues such as this should now be resolved.[43]Upon sale of Uber Eats in India, data in relation to Uber UK Eats/Rides was wrongly transferred to Zomato in India. Zomato deleted the data within 6 days. Ms Chapman states that there is 'little evidence of any UK based users of the Uber app receiving any unsolicited materials." ULL say that 'no notification of the breach was required to any data protection authority" and there is 'no legal, regulatory or security requirement to segregate data as it relates to different lines of business." Whilst I am satisfied that little or no harm actually done, the matter is of concern and weighed in my considerations.[44]Finally, a 'data outage' allowed two drivers to undertake three trips after their insurance certificates had expired. I comment elsewhere in my reasons about, perhaps, a reluctance to go on the record before the full facts are known or risking an overstatement of any potential problem. Ms Chapman says that there should have been earlier disclosure. I agree with TfL's position. Mr Heywood concedes that "notification to TfL should have been more prompt. I apologise for that. We will take this on board in respect of future notification to TfL of similar complex incidents." I note the recognition of the obligation for the future.[45]I observe that the 'fit and proper person' test is not a test of perfection. It is "an expression directed to ensuring that an applicant for permission to do something has the personal qualities and professional qualifications reasonably required of a person doing whatever it is that the applicant seeks permission to do" . A holistic view is required.[46]Notwithstanding the positive assessments by KPMG and PA Consulting, Ms Chapman continues to have concerns. She says "it is fair to say that it is relatively early days and that more time is required to be confident that these interventions have sufficiently embedded." In particular she still has some doubt as to the adequacy and reliability of DLL's complaint handling processes because of the use of multiple tools (page 386). She states that recently, "during the August 2020 Assurance Report period, we noted that there were three suspension notifications made to TfL without verbatim safety related complaints included." She also noted a change from, 123 to 79, in the number of reported breach-impacted trips undertaken by one of the drivers in the driver photo fraud (August 2020 Report). Summary of Conclusions[47]TIL invite me to consider whether ULL's overall track-record of breaches and systems changes is sufficient to give the Court confidence that ULL is fit and proper to hold a PHV operator's licence.[48]I weigh ULL's record on breaches of regulations and impact on public safety. I take into account their number. Public confidence in the licensing regime is a clear consideration. Some breaches in themselves are just so serious that their mere occurrence is evidence that the operator is not fit and proper to hold a licence. I do not find this to be one of those cases.[49]I bear in mind the impact of Programme Zero in reducing the occurrence of breaches. I also take into account improvements in ULL's Board oversight, including a key new appointment and their understanding of regulatory breaches. I take into account the actions taken.[50]I do not find any evidence of concealment or 'cover up' on the part of ULL as regards the driver photo fraud issue.[51]I have weighed ULL's record of engagement with TIL and clear improvements in communication.[52]Cognizant instructed by TIL had initially found that ULL's ITSM processes were not to appropriate standard. TIL accept that there have been subsequent changes and that, now, ' ULL's ITSM processes are now of a standard that they would expect of a company in ULL's position. ULL's changes have plugged the gaps identified by Cognizant." This was the residual area of concern in terms of systems and processes. I find it has been adequately addressed.[53]Despite their historical failings, I find them, now, to be a fit and proper person to hold a London PHV operator's licence.[54]DLL's appeal is allowed. Having heard further submissions, I grant a PHV operators' licence to ULL for a period of 18 months with conditions as agreed by parties and annexed to my judgment. ULL to pay TfL's costs in the sum of £374,770 to be paid by 26 October 2020. Tanweer Ikram Deputy Senior District Judge 28 September 2020