Industrial Tribunals Northern Ireland Decisions

THE INDUSTRIAL TRIBUNALS

 

CASE REF: 1811/16

 

 

 

CLAIMANT: Adam Broad

 

 

RESPONDENT: Barbara Shanks, t/a Shanks & Company Estate Agents

 

 

DECISION

 

The unanimous decision of the tribunal is that the claimant was unfairly dismissed by the respondent. The respondent shall pay the claimant £10,017.35.

 

 

Constitution of Tribunal:

 

Employment Judge: Employment Judge Bell

 

Members: Mr I Rosbotham

Mr P Sidebottom

 

 

 

Appearances:

 

The claimant was represented by Ms A McLarnon, Barrister-at-Law instructed by Norman Shannon & Co Solicitors.

 

The respondent was represented by Mr M Boyd, Barrister-at-Law instructed by Murphys Solicitors.

 

 

1.             The claimant in his claim presented to the tribunal on 12 August 2016 complained that on 19 May 2016 he was unfairly dismissed by the respondent by reason of disputed misconduct on the grounds that his dismissal was procedurally and substantively unfair.

 

2.             The respondent in her response resisted the claim and contended the dismissal was fair.

 

THE ISSUES

 

3.             The relevant issues for the tribunal were as follows:

 

(i)             Has the respondent shown the reason for the claimant's dismissal?

 

(ii)           Did the respondent act reasonably in treating the conduct as a sufficient reason for the dismissal?

 

That is;-

 

a.         Did the respondent believe that the claimant was guilty of the misconduct alleged?

 

b.         Did the respondent have reasonable grounds upon which to sustain a belief in the claimant's guilt?

 

c.         At the stage the belief was formed on those grounds had the respondent carried out as much investigation into the matter as was reasonable in all the circumstances?

 

d.         Were the procedures adopted within the band of reasonable responses for a reasonable employer in all the circumstances?

 

If the claimant was unfairly dismissed:

 

(iii)          Did he by his conduct contribute to his dismissal such that a percentage reduction of any compensation should be applied?

 

(iv)          If there was a procedural irregularity rendering the decision to dismiss unfair did it make no difference to the outcome such that a Polkey reduction should be applied to any compensatory award?

 

EVIDENCE

 

4.             The tribunal considered the claim, response, agreed bundle of documentation, claimant's schedule of loss, written statements of Barbara Shanks, sole proprietor of Shanks & Co Estate Agents, Stanley Craigs, the respondent's husband and employee responsible for business financial services, John Collins, the respondent's IT consultant, Mr William Wilson, the respondent's accountant, Mr Justin Bentley, IT consultant for the claimant and the claimant, together with their oral testimony.

 

RELEVANT FINDINGS OF FACT

 

5.             The claimant was employed as a Trainee Estate Agent by the respondent from
12 March 2015 until his dismissal on 19 May 2016 for gross misconduct.

 

6.             The respondent has no internet use policy or written disciplinary procedure.

 

7.             Prior to events in May 2016 the respondent considered the claimant an honest and valued staff member.

 

8.             In or around early April 2016 the claimant noticed a problem with the respondent's property management software, 'Edge', freezing, which he initially reported to GDC, the Company who were responsible for the software and thereafter to Mr Collins who provides IT consultancy services to the respondent in his free-time.

 

9.             On 8 April 2016 the respondent's computers suffered a ransomware attack, all its files were encrypted and resulting from this all computer data was lost including sensitive customer information, the respondent's diary system and property details, and the respondent's business greatly inconvenienced. No data backup was available because the external hard drive had not been manually disconnected by Mrs Shanks or Mr Craigs on the evening of the attack. Mr Collins described the situation as a ' nightmare'.

 

10.          Neither Mrs Shanks or Mr Craigs had a great understanding of IT and were heavily reliant upon Mr Collins for his IT advice and support.

 

11.          Following the attack Mr Collins removed the respondent's server to clean it and to re-install (security) software.

 

12.          On Friday 15 April 2016 Mr Collin's returned the respondent's server and as per the claimant's clear evidence Mr Collins subsequently, in the week commencing
18 April 2016, showed him how to back up the respondent's computer files manually and provided to the claimant the password to provide full administrative access to the server to be able to carry out this new duty.

 

13.          On 11 May 2016 following on from a telephone conversation between Dominic Bradley of GCD and Mr Collins about a high level of activity on the respondent's system, Mr Collins remotely accessed the respondent's server to check Malware reports, to see what processes were running via the task manager and who had been logged into the server. Mr Collins found 'poker.exec' running under the claimant's account on the server. Later that evening Mr Collins called at the respondent's office to visit Mr Craigs. The claimant was sitting alone in the main office at his desk and Mr Collins asked him if he had been accessing poker sites, the claimant replied how would a 50:50 split sound. Mr Collins told the claimant to stay off poker sites and then proceeded into Mr Craigs' office, he made no mention to Mr Craigs of holding a suspicion that the claimant appeared to have been accessing poker sites from the respondent's server. Mr Collins had not at that point given any consideration to the times and dates of access of the respondent's server or whether this may have been remote.

 

14.          On 12 May 2016 Mr Collins on further investigation identified malware protection ' Malwarebytes' had been removed from the respondent's server leaving it vulnerable to attack by viruses. Mr Collins logged on to the respondent's server under the claimant's account using the claimant's log in details and found there to be a shortcut to gambling software called ' Betfair' on the claimant's desktop on the respondent's server, the shortcut did not appear on the claimant's work PC in the front office. Full administrative privileges are required for the installation and removal of programs on the respondent's server.

 

15.          Subsequently on 12 May 2016 Mr Collins made telephone contact with the claimant to enquire if he had uninstalled the Malwarebytes software and installed 'Betfair' on the respondent's server, the claimant responded ' Don't worry about it we will be ok'. The claimant then suggested he would give Mr Collins a 50:50 split of money made ' to keep schtum'. The claimant's colleague Megan McCormack entered the office during the telephone conversation and overheard the claimant on the phone say 'Yeah, Yeah, I do it all the time, if you keep quiet I'll give you half'. Ms McCormack considered that the claimant seemed to be joking. After the call had finished
Ms McCormack asked the claimant about it, he explained Mr Collins had been asking him about a betting situation, that he was joking but Mr Collins was taking it seriously. Ms McCormack suggested to the claimant he should telephone
Mr Collins back to clarify that the claimant was joking but he did not do so. It was in dispute whether the claimant during the call had in fact specified a 50:50 split of the sum of £20,000 to Mr Collins or just referred to ' a few grand'. We find as supported by the transcript of the disciplinary hearing that Mr Collins did not hear reference being made by the claimant to the sum of £20,000 in the course of the call, nor did Meghan McCormack specify, when later interviewed, having overheard a particular amount mentioned and on balance find more probable that the claimant did not particularise the sum of £20,000.

 

16.          Following his telephone conversation with the claimant Mr Collins phoned Mr Craigs and informed him that the claimant's log in details had been used to download and install ' Betfair' on the respondent's server and access betting websites using the web browser on the respondent's server and that when Mr Collins had called the claimant he had offered Mr Collins a bribe. No consideration was given at that stage to the times or dates of activity. Mr Craigs understood Mr Collins to consider the claimant responsible for the activities identified.

 

17.          At approximately 15:45 just before Mrs Shanks was about to leave for a valuation booked for 16:00 Mr Craigs relayed to Mrs Shanks what Mr Collins had told him. Contrary to the evidence given by Mrs Shanks we find more probable Mr Craigs' evidence that no discussion or explanation took place between them at that stage regarding possible remote access of the server. On Mrs Shanks return to the office just before approximately 17:00 she and Mr Craigs asked the claimant into a private office without prior notice and put to him the allegations made by Mr Collins which he denied. The claimant was not asked about remote access, visits to Russian websites or times and dates of website visits. The claimant explained that he had thought Mr Collins had been joking with him and asked that Mr Collins come to the office but he could not attend. Mr Craigs asked for Mr Collins to provide evidence to support the allegations in response to which he sent through screenshots of the claimant's opening page under 'Server Manager' showing a shortcut to 'Betfair Poker', the claimant's Mozilla Firefox history, showing visits to Betfair and other sites, an e.mail.ru website history showing visits to Betfair and a windows task manager report showing activity involving 'Poker Client.exe' under the claimant's user name, dates or times of activities were not shown. Mr Craigs showed the screenshots to the claimant who noted them as showing an internet history, a Betfair shortcut icon on a desktop, a Russian email website Mail.ru and a transaction on Betfair under the used name Viktor. The claimant denied responsibility and queried whether it could be to do with the previous security vulnerability which allowed the ransomware attack. The claimant pointed out that the website shown on the screen was in Russian and asked why he would want to visit a Russian website. Mr Craigs replied ' who knows what sort of things pop up when you look at these websites'. Mrs Shanks and Mr Craigs expressed concern that the claimant had been wasting office time and at the potential damage that could have been caused to the respondent's computer system. Mrs Shanks put to the claimant that if he admitted the matter at this stage it could be dealt with by a warning but it otherwise would be more serious and could affect his continued employment. The claimant responded that that he would not admit something he had not done. Mrs Shanks asked the claimant to return his office keys and to report to work as normal on Monday 16 May 2016 (after pre-booked leave on Friday
13 May 2016). The meeting concluded after approximately half an hour, no notes relating to it were taken and no copy documentation was provided to the claimant to take with him.

 

18.          After the claimant left the meeting on 12 May 2016 Mr Craigs asked Mr Collins to provide additional evidence of the alleged activities by the claimant on the respondent's computer system. Mr Collins met briefly with Mr Craigs and
Mrs Shanks to discuss the matter, no notes were taken.

 

19.          On 13 May 2016 the claimant telephoned Mrs Shanks and put to her that he had no confidence in the ability of Mr Collins to investigate the matter due to Mr Collins missing warning signs before the ransomware attack and not having a backup in place. Whilst Mrs Shanks could not recollect, we accept the claimant's clear evidence that he furthermore questioned Mr Collins' impartiality. Finally, the claimant requested that Mrs Shanks consult another expert to look at the matter.

 

20.          On his return to work on 16 May 2016 Mrs Shanks gave to the claimant a letter setting out,

 

' I am writing to tell you that Shanks & Company Estate Agents are considering dismissing or taking disciplinary action against you. This action is being considered with regard to the following circumstances:

 

•                 Downloading software from the internet for personal use exposing the business to the risk of importing viruses.

 

You are invited to attend a disciplinary meeting on a date to be confirmed that is suitable to both parties'.

 

The claimant was advised therein of his right to be accompanied and that the meeting would be conducted by Mr Craigs accompanied by Mr Collins ' an expert witness'. The claimant was suspended and provided with six pages of screen shots as had been referred to in the meeting on 12 May 2016.

 

21.          On his return home on 16 May 2016 the claimant emailed Mr Craigs at 12:25 to deny the allegation made and asked would the respondent help him prove he was not responsible by logging in using his details and leaving Edge and email running on his computer preferably for a few days to see if there was any suspicious activity. The claimant raised that there were no times or dates in the screenshots provided and requested these including for when pokerclient.exe was used and for when Betfair Poker was installed, details of all websites accessed via the server computer in April and May and a copy of diary appointments for April and
May 2016.

 

22.          Mr Collins between 12 and 17 May 2016 provided to Mr Craigs the following further information:

 

•                     Two 'report.wer' reports 'EventTime131073145612878479' and ' EventTime1310713068759148904' both showing ' U1[2]=C:\Users\adam\AppData\Local\Betfair Poker\data\PokerClient.exe'.

 

•                     A library history showing visits:

 

on 17/04/2016 to

 

•          ' UNIBET -Yahoo Search Results' at 14:33,

•          ' William Hill TM ' at 14:35,

•          ' unibet -Yahoo Search Results' at 14:36,

•          ' William Hill- Home of Betting' at 14:37,

 

on 09/05/2016 to

 

•          ' betfair-Yahoo Search Results' at 18:30,

•          ' mail.ru- Yahoo search Results' at 18:33,

•          ' Mail.Ru:no YT a, no Y ck B YHTEPHETE' at 18:33,

•          ' noyta Mail.Ru' at 18:33,

•          ' Betfair Sportsbook' at 20:09,

•          ' betfair.com' at 20:11,

•          ' Play Online Poker' (at betfair.com) at 20:12,

•          ' Online Betfair Poker' at 20:12,

•          ' SetupPoker.exe' at 20:12,

•          ' Betfair' (myaccount.betfair.com) at 20:25,

 

on 10/05/2016

 

•          ' Betfair' (myaccount.betfair.com), two visits on two occasions at 00:03.

 

•                     In Betfair Poker under the claimant's name a ' casino' application modified 05/05/2016, created 09/05/ at 20:19.

 

•                     A download library history showing ' Set upPoker.exe 874kB- betfair.com-
9 May'.

 

•                     A whole computer scan ('Started:; 16/05/2016,11:07:50 Finished:;12:21:25) showing seven instances of ' flash player' attempting to download (deleted by antivirus) with the claimant's name as user.

 

•                     A history of ' internet explorer' showing Unibet trying to be accessed and blocked.

 

•                     A ' Windows Task Manager' report showing ' Pokerclient.exe*32' under the user name ' adam'.

 

•                     A ' Programmes and Features' report showing 'Betfair poker' installed 09/05/2016.

 

23.          Mr Craigs replied at 14:38 on 16 May 2016 by email to the claimant attaching ' further copies of virus reports, website activity and downloads on your log in' being part of the additional information which had been provided by that stage to him by Mr Collins. Mr Craigs set out that they were monitoring the computer system on a daily basis, would provide access to the business diary at the disciplinary meeting and concluded, ' I would appreciate if you could provide a time and date as soon as possible. I do not intend to discuss this matter further by email, you will have your opportunity at the disciplinary meeting'.

 

24.          The claimant from the additional information provided to him considered the alleged activity shown to have occurred on Sunday 17 April 2016 from 14:32 to 14:38 and Monday 9 May 2016 from 18:30 to midnight and that Betfair poker software was downloaded at 20:12 on 9 May 2016.

 

25.          The claimant responded to Mr Craigs by email at 20:09 on 16 May 2016 and confirmed that he would contact Mr Craigs in the morning to arrange the disciplinary meeting as he wished the matter to be resolved as soon as possible.

 

26.          By email to the claimant sent at 11:21 on 17 May 2016 Mr Craigs confirmed that the disciplinary meeting would take place that day at 5pm and attached ' some additional reports for your information' being the remainder of the additional information which had then been provided by Mr Collins to him.

 

27.          Prior to the disciplinary hearing Mr Craigs checked alarm records to ensure that the respondent's premises had not been entered outside business hours to coincide with the dates and times on which activity on the server had been noted.

 

28.          Remote access, otherwise 'hacking', of a server without permission, is a criminal offence under the Computer Misuse Act 1990.

 

29.          At 17:00 on 17 May 2016 the claimant attended unaccompanied the disciplinary meeting chaired by Mr Craigs accompanied by Mr Collins. Mrs Shanks was present to take notes. It was agreed that the claimant could record proceedings. Mr Craigs at the outset indicated that he would ask a number of questions which might lead to others and the claimant might want to ask questions and Mr Collins was there as ' our IT expert to explain some of the things, because we are not as au fait as other people are'.

 

30.          In response to Mr Craigs' direct questions the claimant whilst confirming that he was familiar with that type of website denied that he downloaded software or tried to access any gambling websites including Betfair, William Hill, Unibet, Poker, Casino via the respondent's computer systems at any time and confirmed that he could not explain nor understood why there was a Betfair shortcut on his personal server log in, nor why Setup Poker was downloaded on 9 May under his name stating ' I don't know what third party did that but it definitely wasn't me'. Mr Craigs referred to the historical record showing sites accessed at different times and dates which the claimant agreed showed on 9, 17 April and 9 May 2016 sites accessed by someone but denied it was him. Mr Craigs then put to the claimant that someone had downloaded Poker Client with his access code. The claimant acknowledged that the task manager showed it running via his system, that it showed his name, could not deny it had happened but said that it was not him, to which Mr Craigs responded ' Okay so Johnny you explain how possibly Adam could have done it?' The claimant suggested he could instead ' cut to the chase' and with Mr Craig's agreement proposed asking three questions ' just to get your opinion yes or no'.

 

31.          The claimant then put his first question. The transcript records:

 

'A: The first one will be about how viruses [sic] work- is it a fair assessment to say that viruses get onto your computer via unknown they try and disguise themselves and they can get onto the computer.

 

They can be accessing files and they can be doing things behind the scenes on a computer without the computer user being aware- would that be a fair statement?

 

Johnny: I wouldn't say that would be a virus, that would be a hacker.

 

A: But it could be a virus, it could be ransomware, it could be Trojan Horse, it could be anything, but it would be acting on a computer system without a computer user being aware.

 

J: I think that's quite a guiding, kind of, question, like.

 

A: It is a very simple answer'.

 

Mr Collins tried then to refer the claimant to matters discovered by the anti virus but the claimant directed him back to his question, Mr Collins replied:

 

'J: Well I'm not going to give you a yes or no answer there, I would prefer to stick to what I have in front of me here which is what the antivirus pulled up.

 

A: Why can't you answer a simple question?

 

J: I'm answering a simple question, no I don't believe a virus could do that- I believe a hacker could do that.

 

A: A virus can't operate behind the scenes on a computer without the computer user being aware?'

 

Mr Collins questioned why it would then just use the claimant's account and not that of Mr Craigs or Mrs Shanks. Mr Craigs intervened and put:

 

'S: Listen, answer that question, Adam?

 

A: You've brought me in here to try and explain - I'm trying to explain, so if you could answer the question and I will explain it.

 

J: Sorry, I don't think that I have any questions to answer, Adam you are the one answering the questions.

 

A: I'm not saying that.

 

J: I've been asked to come here - if you have all the paperwork to prove to me.

 

A: Why is this such a hard question to answer, this is very simple.

 

J: I'm not going to get involved in this, Adam, I'd just like to know and I was pointed out to Stan and Barbara that on five occasions you downloaded and tried to install - well I don't know you, but certainly your, under your pseudonym, under your account on the server, tried to download and install Flash Player five times'.

 

The claimant again directed Mr Collins back to his question and asked was
Mr Collin's response not contradicted by the circumstances of the recent ransomware attack. Mr Collins responded 'Once again you are trying to lead me here, Adam, and I'm not accepting it...'. Mr Collins referred to what the claimant had said when Mr Collins had first discovered matters, the claimant put that it was such a ludicrous allegation, he had thought Mr Collins was joking but acknowledged it was flippant to have responded as he did and he deeply regretted that he had not taken the matter more seriously. The claimant again referred back to his point:

 

A: 'but coming back to where I'm coming from I just want to get this clear because Stan and Barbara don't understand viruses.

 

J: This is the thing you see, I'm not going to go down that route, Adam, I'm telling you now. With all your recording, you can do whatever you want, you can bring in your expert witness, you can bring a third party in there, okay.

 

If it's a virus it's a very curious one because it hadn't hacked anybody else's account except yours'.

 

Mr Collins put to the claimant what had made him suspicious was that the claimant first said when asked about the matter ' how did 50/50 sound' and on the second occasion how did ' a couple of grand sound' and Mr Collins queried why the claimant had not asked then could it be a virus. Mr Collins questioned the suggestion that the claimant thought he was joking and asked why offer him money to be quiet. The claimant questioned Mr Collins understanding that the claimant was serious in referring to a 50/50 split of £20,000, Mr Collins responded he did not hear the claimant say that but recollected being offered a few grand to keep ' schtum' which the claimant agreed was the word he had used but pointed out that he was joking and laughing. Mr Collins responded:

 

J: 'Well see, Adam, that's well and good, but at the same time if you want to bring in an expert in antivirus things, you go ahead.

 

A : Well, we're kind of getting stuck here.

 

J: However, with things starting logging onto your account, it could be done remotely. There was also kind of other things going on'.

 

Mr Craigs added that all the reports pointed to the claimant and were under one log in, which was the claimant's. The claimant responded ' Okay, so you won't answer the first question'.

 

32.          The claimant proceeded to put his second question:

 

A: 'The second question I want to say to you, is it possible given that the computer system has been vulnerable to an attack in the past that it could be vulnerable to similar attacks at present?'

 

Mr Collins clarified that the claimant was referring to the 'crypto virus' and confirmed the crypto virus does not go in ' and pretend and download Poker Games', but comes in ' sites like that' and encrypts all files and tries to get a ransom. Mr Collins stated that he had cleaned the respondent's 'machine to the bone'. Mr Collins then referred the claimant to what he saw that made him suspicious and pointed out that when he first confronted the claimant he had thought he ' was doing poker games, just skiving of[f] work' and again questioned why the claimant ' just went, oh, I'll give you 50/50', the claimant again replied he thought it was a joke, did not take
Mr Collins seriously and believed that Mr Collins was winding him up. Mr Craigs asked the claimant why Mr Collins would do that, the claimant stated he had already answered that question and referred back to his own point:

 

A: 'Now, so you won't say that it's possible that the virus could still be or the computer system could still, it might be under threat '.

 

Mr Craigs questioned if a computer/ virus would act in that manner, in response the claimant asked for a chance to make a statement but Mr Craigs again queried if a virus would go into mails/ Betfair etc. Mr Collins confirmed a virus would not work like that and it was put to the claimant that someone physically went in, opened up his browser and accessed the sites. The claimant stated he had ' talked to a lot of people in the last couple of days that said yes that can happen - that remotely it can access sites, and these sites can be used to download extra malicious software that opens up the system for more attacks'. Mr Collins questioned how come then the claimant's ' pseudonym' was being used, the claimant replied that he did not know. Mr Craig asked if the claimant had told someone his password and
Mr Collins questioned why the claimant had been chosen rather than other staff. The claimant suggested that emails were a source of vulnerability for the system, Mr Collins questioned this and the claimant responded that it was not for him to explain but for the respondent to prove it was him ' because I'm guilty until proven innocent here' and put ' you won't even answer simple questions with a yes or no' and re-stated his point that even if the machine was wiped clean and proper procedures followed that there was a chance it was vulnerable to similar attacks and concluded ' If you're not going to not say yes or no that's fine'.

 

33. The claimant then began to state his third point, that if he could prove ' that I wasn't in the office via the diary at the times these sites were visited', Mr Craigs interjected to ask why the claimant needed to be in the office and claimant queried how otherwise would it happen . Mr Craigs responded:

 

'S: Dear God, please don't throw the innocent card Adam. You're a smart guy, you tell me you can't remotely access it?

 

A: How the hell would I do that?'

 

Mr Craigs rejected the claimant's suggestion that it would be relevant if he could prove he was not in the office stating ' Because it can be remotely accessed as you damn well know, you know that'. The possibility of remote access had not previously been raised with the claimant. The claimant asked would there not then be a history of remote access on the computer, Mr Collins replied ' Well we can drag them files up but'. The claimant repeated his question and Mr Collins stated ' If you want to bring a third party in, I'm not even going to get into that here' and put that irrespective of whether access was remote or not everything was coming up with the claimant's name on it. Mr Craigs dismissed the claimant's third point as valid ' because it can be remotely accessed as you know well'. The claimant enquired whether there was a history of remote access via a third party and asked Mr Collins 'can you go and get that now?' Mr Collins responded 'Your account was accessed - remotely yes maybe, well I'll get someone, I'll get a third party in, or you can get a third party in they can rip the thing apart to look for that, if you want to'. The claimant questioned did it not sound bizarre to suggest he would ' sit at an undisclosed location, access a computer in work, a front computer in work from a remote location, go onto that computer and then go onto the back computer of that one from a remote location, download Poker and start gambling and playing poker from a remote location'.

 

Mr Collins referred the claimant to his specific log in details for the server computer having been shown to access websites and download Betfair. The claimant directed Mr Collins back to the scenario he had put of access from a third party location which Mr Collins confirmed could be done, the claimant questioned again was it not bizarre, Mr Collins replied 'Well we need to bring in another expert'. The claimant again put how bizarre the suggested scenario was, that he did not have the skills or know how it is done and questioned in any case why he would do it because if he wanted to gamble he could use his laptop at home or his mobile phone if at work and not want to get caught . Mr Collins asked if the claimant had been doing that before the 'crash' using the respondent's Wi-Fi which the claimant denied. Mr Craigs put to the claimant 'You obviously have a knowledge - you seem to have a good knowledge of these websites'. The claimant again asked was the scenario not bizarre, Mr Collins put that it was the claimant's response when confronted in offering Mr Collins money which was bizarre. The claimant again explained he thought it was a joke which Mr Collins questioned given that he did not know the claimant well enough to ring him up and joke. The claimant asked could it not be that a third party had hacked in and stated that was what he thought had happened. Mr Collins queried it having been the claimant's account rather than of anyone else and referred back again to the claimant's response on confrontation, the claimant replied that he had already answered. Mr Collins stated ' Well, there you are. If you want to bring a third party' and ' If you want to, kind of, take that evidence and then disprove it that it wasn't you then that's fair enough'.

 

34. The claimant then referred to dates and Mr Craigs queried their relevance. The claimant contended that if he could prove he was not in the office at the relevant times that should go toward proving that he was not responsible. Mr Craigs acknowledged they were aware some of the relevant days were Sundays and claimant was not in the office having checked their scanner alarms to confirm the premises had not been accessed. Mr Craigs put to the claimant ' We've already established you don't have to be in the office to have done this'. The claimant responded 'this is bizarre', stated he would be at his mother's house at 2:30 pm on a Sunday and pointed out that the first website accessed was:

 

' 14:32 on a Sunday @UK.search Yahoo - search for FPJGJ.

 

Then we've got Unibet, then we've got a Russian search, we've got r.search.yahoo.com which is a search on a Russian website - Russia being the home of cybercrime by the way, so we've got four of them.

 

We've got one William Hill visit, just to William Hill. We've got a search for Skrill. We've got a Yahoo search for Unibet, we've got another Russian search, we've got a William Hill home of betting, we've got two more Russian searchers [sic] on Yahoo.

 

These occurred on 17 April at 14:32 to 14:38 when I wasn't in the office, it was a Sunday as you are well aware. I would posit that it's far more likely some third party source is hacking in and going on this'.

 

Mr Collins responded that they could not hack in without the claimant's password and questioned why it was just the claimant hacked, the claimant replied that he did not know and referred to the system being hacked before to try and get money for encrypted files. The claimant again pointed out that the list was of Russian and betting websites visited on a Sunday between 14:32 and 14:38, that he was clearly not in the office, could not access them, did not know how to from a third party location and the password, 'password1', was easy. Mr Collins questioned how a hacker would know the claimant's login ' Adam'. Mr Collins rejected the claimant's response that it could be from a history of who had logged on because the hacker would need to get in first. The claimant stated:

 

'A: Listen if I have to go and explain I will, I'll get somebody to explain how all this stuff works, but I'm not the expert in it but I've been told that this stuff is very easily done.

 

Key loggers - I've spoken to a few expert people, I've spoken to an account manager at Insight IT in Sheffield. I've spoken to another couple of people, I've spoken to a guy, Jacky Campbell, who used to work for ...

 

J: Well where are they, man - you get them here and get them to look at the machine and see if they can find the key logger, the key logger viruses, because I would like them to come.

 

If there are key loggers on there I think it's everyone's interest to find them. If there is someone putting a key logger on the server...'

 

Mr Craigs, although as acknowledged in his evidence at that stage did not understand remote access, again disagreed with the claimant as to the relevance of the activity being on a Sunday, the claimant countered this pointing out that
Mr Craigs had looked at the times before he came to the claimant. Mr Craigs again stated ' You do not have to be in the office, we've already established that' and ' There is a way of doing it and you know how to do it. Mr Collins referred to setupoker.exe ' downloaded into your thing and downloaded there' which the claimant pointed out was at 20:15 on 9 May. Mr Collins queried if it was a key logger how come it had stopped. The claimant replied that a key logger would not be making a bet and questioned how they could fathom it was him and again denied that it was. The conversation continued:

 

'S: Adam we've already established you don't need to be in the premises.

 

A: Well how the hell am I going to do it? .. where's the evidence?

 

J: Evidently there is someone logging in, someone was logged in using your account.

 

A: Yes, and I'm trying to say it doesn't necessarily mean that it was me because my account - I haven't been in the building.

 

J: But it's your account.

 

A: I haven't been in the building.

 

J: Well obviously it was done from external.

 

A: So how do you do that?

 

J: You tell me.

 

S: You tell us.

 

A: Well no you are the ones making the claim'.

Mr Collins rejected the claimant's argument that because the claimant was not in the office when his account was used to access sites and install Betfair that it could not have been the claimant pointing out that he himself did not need to come in to do ' something on the server', the claimant pointed out this was because Mr Collins had an access set up, Mr Collins stated that the claimant had been given access rights to back up files to which the claimant responded:

 

'A: But I have no idea how to remotely...

 

S: There is a way of doing it, that's all.

 

J: I have to go here, because I have things to do and...'.

 

The claimant then put to Mr Collins that he had made accusations without proper investigation and was running away, both of which points Mr Craigs and Mr Collins rejected. The claimant questioned the investigation and Mr Collins again referred the claimant to his undisputed offer of money for him to be quiet, the claimant again stated it was a joke. Mr Craigs intervened:

 

' S: This is not, sorry, to be an argument with you and Johnny, alright. John if you have got things to do thank you for your time....

 

A: Well there's still plenty...'

 

Mr Collins again referred to the claimant's name showing and in response to the claimant's reply that 'It's been proven a hacker...' stated 'You prove, you prove the hackers - you bring someone in to prove there are hackers then'. Mr Collins
re-iterated that he had asked a question rather than make an accusation when he had approached the claimant and the claimant again referred to his response being a joke at which point Mr Craigs intervened, he thanked Mr Collins and Mrs Shanks bid him goodbye, Mr Collins left the meeting.

 

35.          Mr Craigs then told the claimant ' We are not technical so you can stop the technical stuff okay', and confirmed that he and Mrs Shanks would decide after the meeting upon disciplinary action, if any, and if taken there would be an appeal process and ' then it's at that stage you could get a third party to look at it to make an argument, alright' and ' Barbara is the owner of the business, she also may have to decide'. The claimant agreed to share his recording with the respondent. The claimant asked to make a closing statement, Mr Craigs responded ' Don't ask any IT stuff because we are not...'. The claimant summarised his points; that the office was closed and he was not there; the remote access suggestion from a third party location to visit Russian websites and set up poker were ludicrous; Mr Collins accusation was wrongly taken as a joke; and ' world of hacking' was outside his knowledge. Mrs Shanks asked the claimant had he used ' those Betfair sites outside work?', he confirmed that he had never used Betfair and whilst it would bring more scrutiny upon him admitted he had used poker websites outside work and stated ' I'll tell you that because I don't tell lies'. The claimant asked Mr Craigs and Mrs Shanks to go over the matter and 'really look at it' referring to the presented scenario as absolutely bizarre, Mr Craigs responded that it not as bizarre as the claimant's argument that a hacker who had gone in on his password was responsible. The claimant referred to the previous hack of the computer, Mr Craigs replied that the computer had been cleaned, the claimant responded that it would still be vulnerable to new attacks which he was informed are now so sophisticated an advertising banner on a website could infect your computer. Mr Craigs replied ' Alright, well we are not IT' and 'I'm disregarding that because I don't understand that quite frankly'.

 

36.          Mrs Shanks began to read aloud her summary of the disciplinary meeting, the claimant interrupted, agreed to sign the minutes and provide a copy of his recording which Mrs Shanks acknowledged would be more accurate. The claimant expressed his wish to go back to work the next day but Mr Craigs confirmed a decision would have to be made first which would be done within 24 hours unless longer was required.

 

37.          The disciplinary meeting was not well controlled throughout by Mr Craigs. Exchanges between Mr Collins and the claimant were 'heated' and Mr Collins did not act in accordance with his purported role of an independent IT expert present to answer the questions of both parties but in the majority took over the role of
Mr Craigs in asking questions and did not fully or willingly answer questions asked by the claimant as supported by the evidence of Mr Craigs and Mrs Shanks at hearing.

 

38.          There was a conflict in the evidence of Mr Shanks, Mr Craigs and Mr Collins as to when the investigation into the allegations against the claimant had concluded. We note the evidence of Mr Collins who accepted that he did not know the answers to all of the questions raised by the claimant and find most probable Mr Collins' evidence that the investigation was continuing at the disciplinary hearing and had not concluded prior to it.

 

39.          No formal meeting took place following the disciplinary meeting between Mr Craigs or Mrs Shanks and Mr Collins to address issues raised by the claimant during the disciplinary hearing before a decision was reached and there was a conflict in the evidence of Mr Collins and Mr Craigs as to whether Mr Collins' involvement had concluded when he left the disciplinary hearing. We note however Mr Collins' evidence that he had advised the respondent before and after the disciplinary meeting that a forensic person could get remote access files, and find more probable the evidence of Mr Craigs that he asked Mr Collins for clarification on a number of the issues raised in the disciplinary hearing, when Mr Collins was in and out of the office thereafter, prior to a decision being made.

 

40.          The claimant by email at 18:42 on 17 May 2016 forwarded a copy recording of the disciplinary meeting to Mr Craigs.

 

41.          Mr Craigs on 18 May 2016 emailed the claimant and requested additional time to make a decision due to the complexity of the issue and subsequently on
19 May 2016 arranged for the claimant to call at the office at 16:30 that afternoon.

 

42.          Mr Craigs recommended to Mrs Shanks following the disciplinary meeting that the claimant be dismissed for gross misconduct.

 

43.          On 19 May 2016 the claimant realised that the internet history provided to him on the morning of 16 May 2016 differed from that provided as part of the additional information given to him on the afternoon of 16 May 2016 and on 17 May 2016 in which visits to Russian pages, Betfair, and Online payments & Money were subsequently absent.

 

44.          The claimant attended a disciplinary outcome meeting with Mrs Shanks and Mr Craigs on 19 May 2016. Mrs Shanks thanked the claimant for the extra time given to consider the case and confirmed that the facts presented to her clearly pointed to him having ' downloaded on the server' and she would have to dismiss him on the grounds of gross misconduct and advised him of his right of appeal. The claimant responded that he had been treated as guilty until proven innocent and referred to Mr Craigs use of the words used ' don't throw the innocent card' meaning a presumption of guilt and put that a proper investigation was not done which
Mr Craigs disagreed with. The claimant put that someone had been tampering with the evidence by deleting history relating to logging into Russian emails. Mr Craigs replied that the claimant's points were not for now and referred him to his right of appeal. The claimant put that he had been bullied, harassed and ganged up on in the disciplinary hearing by Mr Craigs and Mr Collins and not given a chance to speak, Mr Craigs disagreed and again referred to his right of appeal. The claimant put that Mr Collins and the respondent had thought he had been ' skiving' at the front computer in working hours and stated when the evidence was to the contrary they were:

 

' coming back with some bizarre explanation about remote access. Ultimately I don't think you've contacted another expert because if you are going on what Johnny says, if he proves it's me or if I prove it's him then he looks incompetent and not capable of doing his job. So you've only relied on one expert when I asked you to get somebody else, so I will be going and talking to a lot of people'.

 

Mr Craigs responded ' Yes do' and the claimant said ' I'll be bringing the evidence back here'. Mr Craigs replied, ' Yes, well that's what we want you to do'. The claimant confirmed his intention to appeal, referred again to evidence tampering and expressed the hope that the respondent would on appeal contact an expert. The claimant was given a letter dated 19 May 2016 from Mrs Shanks confirming his dismissal for gross misconduct the nature of which was 'to download software from the internet for personal use exposing the business to the risk of importing viruses'.

 

45.          By letter of 24 May 2016 the claimant wrote to Mrs Shanks to appeal the dismissal decision. The claimant raised that:

 

(i) On putting forward clear evidence that he was not in the office at the times of the alleged activity, a new hypothesis of remote access was presented without evidence, which he had requested, and he suggested there was none.

 

(ii) Tom Dell's security expert (Channel Manager for UK and Ireland of Malwarebytes and from whom he attached a copy email of 20 May 2016) had on consideration of the evidence presented against the claimant stated it was inconclusive and easy to check computer logs to show remote access and from where a system was accessed. The claimant requested logs to show remote access made in April and May.

 

(iii)          There would also be a log of IP addresses on the websites visited from which the location of who accessed the websites and downloaded the software could be fairly accurately identified. The claimant requested IP logs relating to websites accessed on 17 April and 9 May 2016.

 

(iv)          There was a difference in the internet histories given to him and requested a screenshot of each website contained in the initial history in order to investigate further.

 

46. Tom Dell in his email of 20 May 2016 to the claimant set out that his security expert's comments were that the data was inconclusive; Mail.ru was a Russian ISP who provide mail but not necessarily ' dodgy' and had queried 'unless this guy speaks Russian why would he be going to a Russian mail provider?'; and that remote connection could be checked on the VPN or applicable authentication logs on windows.

 

47.          The claimant marked on the copy internet history he attached to his appeal letter
12 site visits missing from the subsequent history (including visits to a Russian site, Betfair, and Online payments & Money).

 

48.          On delivering his letter of appeal the claimant asked Mr Craigs if he would speak to an IT expert, Mr Justin Bentley, Mr Craigs agreed to do so. Mr Craigs subsequently received a telephone call from Mr Bentley on 25 May 2016. Mr Craigs was of the view that that the disciplinary matter had proceeded to the next stage and was not interested in speaking with Mr Bentley, he informed Mr Bentley that he had already had an IT expert who had looked at the matter and he ended the telephone call with Mr Bentley.

 

49.          Mr Craigs by email on 31 May 2016 confirmed to the claimant that they hoped to be back to him by the end of the week with some dates and times for his appeal.

 

50.          On 1 June 2016 the claimant wrote to Mrs Shanks and requested;

 

(i) an explanation of the incident and evidence relied upon to support the finding made against him,

 

(ii)           names of IT consultants spoken with together with documentary evidence of investigations carried out before the allegation was made,

 

(iii)      the appeal be heard by an independent person suggesting that the LRA make a recommendation,

 

(iv) copies of the respondent's disciplinary procedure, his statement of main terms and conditions of employment and respondent's internet policy,

 

(v) that the respondent speak with the claimant's colleagues Ms McCormick and Claire McGuiness, who would be able to confirm the claimant thought
Mr Collins was playing a joke,

 

(vi) the respondent get another IT expert. The claimant suggested that
Mr Collins had a conflict of interest, could not be relied upon to act fairly and was using him as a scapegoat to cover inadequacies in the system's malware and virus protection which Mr Collins was responsible for and was the most logical explanation for the activity.

 

In conclusion the claimant forwarded a copy transcript of the disciplinary meeting and offered to provide evidence from family members to support that he was in their company at the times of alleged remote access and offered his bank statements to show no deposits made to Betfair on or around 9 May 2016.

51. By letter of 3 June 2016 Mrs Shanks forwarded the claimant a copy of his offer of employment. Mrs Shanks stated therein that all documentary evidence used to investigate the allegation was provided to the claimant before the disciplinary meeting and that ' The only additional information that will have to be considered at the appeal is that there hasn't been any further activity on our system since your rights as an administrator were withdrawn'. Finally Mrs Shanks confirmed that the appeal hearing would be conducted by an impartial third party and she hoped to have dates shortly.

 

52. The claimant responded to Mrs Shanks by letter of 6 June 2016 that he found completely unacceptable her statement that no additional information would be considered at the appeal. The claimant again referred to the evidence provided showing the software he was accused of downloading being installed between 20:12 and 20:19 when the office was closed and alarm set and renewed his request for:

 

(i) A full explanation of how and when he was to have done this and supporting evidence.

 

(ii)           Documentary evidence of investigations made to include emails and records of staff/ expert witness statements.

 

(iii)          Documentation requested on 24 May and 1 June to include remote access logs, IP logs, original internet history screenshots, disciplinary procedure and internet policy.

 

(iv)          The respondent to seek corroboration of the claimant's account from colleagues.

 

(v)           An unbiased computer expert to look at the case.

 

53. By letter of 6 June 2016 Mrs Shanks set out to the claimant that there was no internet policy or disciplinary procedure and the respondent follows the statutory disciplinary procedure. The claimant was notified that his appeal would take place at 10.30 on 24 June 2016 chaired by William Wilson, the respondent's external accountant, assisted by Susan Dael, an Independent HR Consultant. The claimant was advised of his statutory right to be accompanied by a work colleague or trade union official of his choice and asked to confirm the identity of his chosen companion by 23 June 2016. Mrs Shanks referred to the written statement submitted already by the claimant detailing his grounds of appeal and raising a number of points for consideration and confirmed ' this will be given to the appeal who will consider all points that you have raised as part of the appeals process' and any additional he wished to provide before and he would be given the opportunity to set out his detailed grounds of appeal including providing any new evidence or new facts.

 

54. Mr Craigs forwarded a copy of the claimant's letter of 6 June 2016 to Mr Wilson by email on 9 June 2016.

 

55. On 9 June 2016 Mr Wilson wrote to the claimant in response to his letter of 6 June 2016 to Mrs Shanks. Mr Wilson confirmed that he had discussed with Ms Dael the claimant's points and they were happy for him to raise these and to hear further submissions at his appeal hearing and all would be given full consideration and ' if we determine that we need to examine anything further at this stage we will do so'.

 

56. On 9 June 2016 the claimant wrote to Mrs Shanks setting out his reservations at the choice of Mr Wilson to chair the appeal hearing because of them being friends who regularly socialised together and again requested she have the LRA appoint a ' truly impartial' chairperson. The claimant specified that information should be examined and available to all parties before the appeal meeting rather than further examination be done afterwards if deemed necessary. The claimant asked:

 

(i) ' With regards to my right to be accompanied are you prepared to let Mr Justin Bentley an independent computer consultant attend the appeal meeting'.

 

(ii)           What Mrs Shanks meant by in her letter of 3 June 2016 that his rights as an administrator were withdrawn and what that entailed?

 

(iii)          Was it was possible evidence was still being manipulated by someone with system access in reference to websites deleted from the internet history?

 

(iv)          Who removed websites from the internet history and why?

 

(v)           For screenshots or the full website addresses of pages found in the internet history to assist him to try to build a profile of whom or what was responsible for the activity.

 

(vi)          For confirmation of Mr Collins' credentials as an IT expert.

 

(vii)         For clarification of the statement that there was no disciplinary procedure and they follow the statutory disciplinary procedure.

 

(viii)       That all issues raised, including by his correspondence of 24 May, 1, 3 &
6 June 2016, be addressed.

 

57. Mr Craigs forwarded a copy of the claimant's letter of 9 June 2016 to Mr Wilson.

 

58. By letter of 14 June 2016 Mrs Shanks responded to the claimant declining his request for removal of Mr Wilson and for the LRA to appoint a chairperson setting out that Mr Wilson was a chartered accountant with in excess of 15 years' experience; had been the respondent's accountant for over 6 years; was a trusted independent impartial business advisor; had previous relevant experience; had always remained completely professional and she had no doubt he would continue to do so and would ensure a fair and correct process assisted by Mrs Dael who was an independent HR Consultant and chartered member of the CIPD. Mrs Shanks confirmed the respondent was adhering to and gave a summary of the statutory disciplinary procedure.

 

59. On 16 June 2016 Mr Wilson wrote to the claimant in response to his correspondence of 9 June 2016 to Mrs Shanks to address points raised in relation to his appeal. Mr Wilson stated ' Your right to be accompanied extends to employees of the company or trade union officials, if Mr Bentley does not fall into either category he will not be permitted in the hearing'. Mr Wilson confirmed receipt of the information that the claimant had also received to respond to the allegations and stated if he wished to raise any further points they would be considered at the appeal stage and that if they felt it necessary for an impartial computer expert to assist following his hearing then they would certainly consider this.

 

60. By email on 21 June 2016 the claimant wrote to Mr Craigs and Mrs Shanks in response to the two letters he had received of 14 & 16 June 2016 and set out that;

 

(i)             The implication of remarks made and his treatment in the process was that he was guilty until proven innocent.

 

(ii)           The nature of the allegation was changed when evidence was presented showing that he was not responsible.

 

(iii)          They had refused to investigate properly and relied solely on the opinion of one person who did not look at times and dates of activity and had a financial interest in placing the blame upon him to defend the security of the system he had set up.

 

(iv)          Full investigation should take place before the appeal rather than it be left to the appeal panel to decide if necessary.

 

(v)           Mr Craigs had at the disciplinary meeting said that the claimant could ' get a third party to look at it to make an argument' at the appeal stage and the claimant expressed his wish for a third party to look at the respondent's machine to show that there was no evidence of him accessing the system outside office hours;

 

(vi)          The claimant's personal home computer had never been set up for remote access.

 

(vii)         The claimant's disappointment at the refusal of his request for Mr Bentley to accompany him at the appeal and stated that it would be 'only fair to return the courtesy' following Mr Collin's presence as an expert witness for the respondent at the disciplinary hearing. The claimant referred to Mr Bentley's 25 years of relevant experience and conversation with Mr Craigs on
25 May 2016 when Mr Bentley's explanation of reasons for the activity seen on the server were dismissed by Mr Craigs on the basis that he did not understand computers and would need to speak to Mr Collins, and which had been the constant position of the respondents and questioned how they had arrived at the decision against him given that at all stages they had cited their own personal lack of understanding.

 

Mr Craigs informed the claimant that he had forwarded the claimant's email to the appeal panel.

 

61. On 22 June 2016 the claimant by email responded to Mr Craigs and pointed out that there were several points in his email and previous correspondence that he would like Mr Craigs and Mrs Shanks to directly address. Mr Craigs replied that he had forwarded the claimant's recent emails to the appeal, they had noted his points and would deal with them and any other points as part of the appeals process, the appeal hearing would be his opportunity to outline in detail his grounds for appeal and requested the claimant's confirmation that he would be attending the appeal hearing on 24 June 2016. The claimant confirmed that he would be attending and sought permission for the meeting to be recorded ' As I have no one to attend the meeting' which Mr Craigs replied on 23 June by email was acceptable and accordingly no written notes would be provided.

 

62. On 24 June 2016 the claimant attended unaccompanied the appeal hearing chaired by Mr Wilson with Mrs Dael as a panel member. Mr Wilson explained that the purpose of the meeting was to listen to the claimant's appeal against the disciplinary decision of 17 May 2016 and would not be a re-hearing. The claimant when asked if he was happy with the panel told Mr Wilson that he had some reservations ' But if this is the way it's going to go then this is the way it's going to go'. Mr Wilson assured the claimant that he had a code of ethics as a member of the Institute of Chartered Accountant's in Ireland and on that basis was totally impartial. Mrs Dael informed the claimant that she had been working in HR for 20 years, was a member of the CIPD and would also be impartial. The claimant responded ' Ok great' and that he was prepared to proceed. Mr Wilson referred to the claimant's right to be accompanied and the claimant raised his request for Justin Bentley an independent computer consultant to come along but that it was denied and that he had made the point that at the disciplinary meeting Mr Craigs and Mrs Shanks were accompanied by an IT expert and he felt it would have been fair to let Mr Bentley come, in response the claimant was told that Mr Bentley would not be within the allowed statutory criteria of being a fellow employee or trade union [representative]. The claimant stated ' No sure I understand that, [h]e has some IT knowledge that probably would have been helpful in this case and that is the reason I made that request to bring him. But we're here today and we'll just crack on with it'. In response to the claimant's questions the panel confirmed that they had the same documentation as the claimant had been provided and had looked over them. The claimant was then given ' the floor' to outline why he thought the decision taken was unfair. The claimant set out a brief time line of events and raised in summary the following:

 

(i) He had taken Mr Collins' approach to him on 10 May 2016 as a joke. When Mr Collins phoned him again on 12 May 2016 the claimant was sitting in the front office and his colleague Ms McCormick sitting beside him, his demeanour was 'joking' and not hushed and on discovering later that day it was not a joke he had been truthful with the respondent from the outset. He was regretful that he had not taken the matter more seriously. Ms McCormack would be able to give an opinion on the nature of his behaviour on the phone call and whether she thought it was a serious conversation along with Ms McGuiness whom he spoke to shortly after the call stating his belief that Mr Collins was winding him up. Further, contrary to Mr Collins suggestion that he did not know the claimant well enough for the claimant to think Mr Collins would joke with him, Mr Collins had joked in the past calling the claimant ' a cold blooded killer' relating to a near miss involving the claimant and a child on a bicycle.

 

(ii)           At the outset on 12 May 2016 Mrs Shanks implied that he was guilty until proven innocent by putting to him that it was very serious and he had been ' kind of skiving off work' and if he admitted to it now he would get a warning but if he did not admit it this would be a serious breach of trust, difficult for him to carry on working there and be treated more seriously. There had been no mention of or consideration given to dates and times at that point.

 

(iii)          An impartial IT expert was not used. On 13 May 2016 he had put to the respondent that he did not have confidence in Mr Collins' competency, he considered him to have warning signs the claimant had alerted Mr Collins to prior to the ransomware attack on 8 April 2016, and had requested another expert look at the matter, but the respondent, who did not have a great understanding of IT, had relied entirely upon Mr Collins. At the disciplinary meeting he had tried to ask Mr Collins questions about IT but that he ' dodged' and refused to answer questions including relating to the possibility malware could be on a computer without a user's knowledge, a possibility confirmed by his expert testimony, and left before the claimant had said all he had wanted and the respondent thereafter would not discuss IT matters with him any further. Mr Collins was not prepared himself to help prove that it was not the claimant, demonstrated lack of knowledge, told the claimant he could get a third party in and had a financial incentive to blame the claimant if he had not wiped and set the system up properly after the ransomware attack. Mr Collins, and Mr Craigs to a degree, had constantly shouted him down so that it was difficult for him to speak and he was not given a fair chance. The respondent still had not been able to explain their decision and evidence.

 

(iv)          He had not had access to all the information to defend himself. Mr Collins clearly had not considered dates and time and investigated properly before making an accusation. At his disciplinary hearing on 17 May 2016 upon pointing out that he clearly was not in the office at the relevant dates and times of access Mr Craigs stated he could have remotely accessed the computers, the claimant had asked how this would be done, denied having done so and sought repeatedly but was refused an event log to show all computers that had accessed the server at that time, was told by Mr Collins he could get a third party in and he was not going to prove that it was not the claimant. The allegation in effect had then changed in nature from ' skiving off' to one of ' remote access' but no evidence of this was provided or the claimant given access for a third party to assess. Mr Craigs' comments implied that he thought the claimant was guilty without proper investigation or evidence of remote access which the claimant repeatedly thereafter requested and was denied. The claimant referred to Tom Dell's letter and Mr Dell's security expert's opinion on the evidence provided and how the VPN or authentication logs could be easily checked for remote access.

 

(v)           On 3 June 2016 he was informed that no more information was going to be considered at his appeal save the lack of activity since on the server; this was not sufficient reason to not investigate further.

 

(vi)          Why and how website histories had been removed. The disparity between the two internet histories provided to him showed somebody with access to the computer system had removed evidence of Russian websites logged into, Betfair activity including card payments and registration and the putting down of money on Skrill, an online money and payment system; his requests for screenshots of these pages to consider further had been denied and he hoped the panel would look at the matter and pointed out that he considered it hard to believe he as a non-Russian speaker would go in and navigate through a Russian email inbox and especially suspicious that someone had been doing so.

 

(vii)        That the evidence showed card deposits made on Betfair on 9 May 2016 but his bank statement for 29 April-31 May 2016 for his only bank account which he provided showed no deposit to Betfair; his statement showed only £10 deposits to Pokerstars which he plays on once or twice a month at home on his own laptop and would have no need to connect to the computer in work to do so.

 

(viii)       He could not be responsible for activity seen on 17 April 2016 because he spends Sundays with his parents for lunch and was with them 14:00-18:00 that day as verified in a signed statement provided by his father.

 

(ix)          He referred to two pieces of expert testimony from;

 

•          A senior executive in a top Northern Ireland Consultancy who had chosen to remain nameless but if required by the panel would be provided and who would be available to speak to them. The claimant read out his expert's explanation of ransomware concluding that a machine can be infected without the user's knowledge, thereafter the user to appear to have been visiting sites/downloading software when it is an automated process occurring from a previous infection, Russian locations being one of the most prevalent and difficult to know that ransomware has been repaired.

 

•          Dr J Espinazo, who the claimant summarised says account names and passwords can be obtained by many means including keylogging malware, sources of which include email attachments and visits to compromised websites; user impersonation is a very common security attack to disguise the attacker's identity and may be confirmed by checking IP addresses of computers logging on to the system from which its location might be identified. The claimant explained this was why he had requested IP logs and believed if checked would probably show the activity had come from Russia and considered it very important to be looked at.

 

The claimant expressed the hope that the panel would deem it necessary to investigate further and the meeting concluded with Mrs Dael confirming that they needed to consider his points fully and they would talk to an independent expert if they deemed it necessary to do so. Mr Wilson did not seek clarification of any issue at any point throughout the meeting.

 

63. On 25 June 2016 the claimant emailed Mr Craigs, copying in Mr Wilson and
Mrs Dael to raise one matter he had forgotten to mention to the appeal panel, that the server computer was taken away following the ransomware attack by Mr Collins, was then returned and was working for the week beginning 18 April 2016 but not until later that week that the claimant was shown how to back up the files and so if accepting Mr Collin's account the claimant would not have had remote access rights on the 17 April 2016 and could not be responsible for the activity seen on that date. The claimant concluded that being shown how to back up files did not grant him access to the system because his laptop had never been set up for remote access nor had he ever worked from home.

 

64. As per Mr Wilson's evidence, IT elements of the case were ' alien' to him and so he handed all technical queries to be made, to Mrs Dael. Whilst Mr Wilson referred to an ' action plan' drafted following the appeal hearing no such document was provided in evidence.

 

65. On 4 July 2016 Mrs Dael consulted with an independent IT expert Mr Jack Eccles in respect of which meeting a one page note was kept. The note recorded that IT documents provided to the appeal panel were reviewed however Mr Wilson at hearing was unable to confirm specifically what information was provided to and considered by Mr Eccles to answer questions then put to him by Mrs Dael. The note records:

 

•                      Mr Eccles conclusion that screen shots examined showed the claimant's profile on the server which showed that the claimant had accessed the website via the respondent's server, by doing so had created security vulnerability in the system to allow software to be downloaded and exposed the business to the risk of importing viruses.

 

•                      Mrs Dael stated that ' IP addresses were not provided and respondent unable to provide this information'.

 

•                      Mr Eccles explained it was not unusual for small companies not to have the costly equipment to obtain IP addresses and given the claimant had accessed the website via the company server and allowed software to be downloaded this point has no relevance.

 

•                      Mrs Dael asked about the Russian website that was downloaded.

 

•                      Mr Eccles explained, the claimant by accessing the gambling website had allowed software to be downloaded, this was a pop up from one of the websites.

 

•                      Mrs Dael stated 'that times and dates of websites accessed was not provided by the company, for the reasons above this point was not relevant'.

 

•                      Mrs Dael asked how ' websites (Betfair) had been removed'' from the history as presented on 17 April and 9 May 2016.

 

•                      Mr Eccles explained the server would automatically clear history after a period of time.

 

•                      Mrs Dael asked about the ability to check log in details, the respondent business did not have a VPN.

 

•                      Mr Eccles explained if it did not have remote workers it was unlikely to have VPN without which it would be difficult to check log in details.

 

As acknowledged by Mr Wilson in his evidence the information supplied to
Mr Eccles was incorrect in relation to the removal of website history being limited to Betfair websites and as to the non-provision of times and dates of website access, furthermore all of the issues raised by the claimant were not dealt with in the meeting with Mr Eccles.

 

66. Ms Dael by telephone spoke with Mrs Shanks on 1 July 2016 to clarify points raised as to the comment made by Mrs Shanks at the outset of the meeting on
12 May 2016 regarding admitting the allegation and telephone conversation with the claimant on 13 May 2016 raising concerns over Mr Collins and recorded a note thereof.

 

67. Mrs Dael consulted by telephone on 1 July 2016 with Ms McCormack regarding her recollection of the claimant's telephone call with Mr Collins on 12 May 2016 and recorded a note thereof.

 

68. Mr Wilson following the appeal hearing met with Mr Collins but could not recollect precisely what was discussed and no notes thereof were presented in evidence. Neither Mr Wilson nor Mrs Dael consulted Ms McGuiness nor the two experts referred to by the claimant during the appeal hearing.

 

69. On 19 July 2016 Mr Wilson provided to the respondent a six page report on the disciplinary appeal hearing which identified ten appeal points and the panel's findings thereon, in summary as follows:

 

(i)             The respondent thought the claimant was guilty of the allegation prior to the decision being taken given the remark made on 12 May 2016.

 

Finding: If the claimant's account were accepted as accurate then it was not appropriate to state a warning would be given if the claimant admitted to the allegation, but it was their view was this had no bearing on the decision to dismiss.

(ii)           The claimant on 13 May 2016 raised concerns with the respondent over
Mr Collins as the computers were running slowly, and suggested getting someone else in.

 

Finding: The point had no relevance in the matter they had been asked to consider.

 

(iii)          The claimant was not provided sufficient information to defend himself.

 

Finding: Following consultation with an external IT Consultant and Mr Collins, IP addresses had no relevance and the claimant had been provided with sufficient evidence to defend himself.

 

(iv)          The claimant's PC was not set up for remote access and he had never remotely accessed the respondent's computer.

 

Finding: The evidence showed someone logging in using his account and the claimant had been given access set up to back up files. It was more probable than not the claimant was able to remotely access the company computer.

 

(v)           The claimant stated that Betfair website pages had been deleted from the evidence presented on Monday 9 May 2016 from the evidence presented on 17 April 2016.

 

Finding: The IT consultant had stated that the server would automatically change this history after a period of time. This had no bearing on the decision to dismiss.

 

(vi)          The claimant presented his bank statement dated 31 May 2016, stated it was his only bank account and during the time in question and no money had been paid out of his account on the dates specified; there were payments to Poker stars for £10, did not ever deny using these sites but the amounts were small.

 

Finding: the evidence was of limited significance save to show that the claimant does access gambling websites.

 

(vii)         The claimant provided a statement from his father to say he had joined them on the afternoon of 17 April 2016 from 14:00-18:00 and at no time accessed his computer.

 

Finding: the point had limited relevance as evidence was not impartial and credible.

 

(viii)       The claimant had thought regarding the 50/50 split comment when Mr Collins raised the matter on the telephone he was only joking and Ms McCormick and another employee had overheard the conversation and would confirm he was joking.

 

Finding: Having spoken with Ms McCormick and Mr Collins, that the claimant knew Mr Collins was serious and tried to prevent him from disclosing the information to the respondent by bribing him, Meghan entered
mid-conversation and the claimant knew he would be overheard so tried to pass his comment off as a joke.

 

(ix)          The claimant asked that an IT expert look at the evidence, it was a security issue, the IT administrator had not set it up properly, and he was being used as a scapegoat.

 

Finding: It was a security issue because the claimant had accessed internet websites via the respondent's server and exposed the business to the risk of importing viruses, both Mr Collins and IT specialist consulted by the panel having agreed the evidence showed this and IT consultant advised it could also have caused potential hacker to use the claimant's credentials download software and exposed the system to virus risk.

 

(x)           The claimant had not been provided the opportunity to speak at the disciplinary hearing; Mr Collins dodged questions and contradicted himself.

 

Finding: The point was rejected it being the panel's view that the disciplinary statutory process was followed, allegation put, claimant asked to respond and that the claimant did.

 

70. In conclusion the appeal panel stated its view that the claimant was guilty; the dismissal fair and proportionate; additional evidence raised not sufficient to affect the decision; matter investigated; disciplinary process conducted fairly; and so no grounds found to interfere with the original penalty imposed.

 

71. On 18 July 2016 Mrs Shanks provided the claimant the appeal panel's report and confirmed that she accepted their recommendation and upheld the original disciplinary decision.

 

72. The claimant presented his complaint to the Industrial Tribunal on 12 August 2016.

 

LEGISLATION

 

73. Under Article 126 of the Employment Rights (Northern Ireland) Order 1996 (ERO) an employee has the right not to be unfairly dismissed by his employer.

 

74. Failure to complete the statutory disciplinary and dismissal procedures (SDP) where applicable will result in a dismissal being automatically unfair under Article 130 A ERO. The standard procedure consists of three steps; the employer contemplating disciplinary action must set out the grounds for the proposed disciplinary action in writing and invite the employee to a meeting. The meeting must take place at a reasonable time, on reasonable notice and the outcome of the meeting must be communicated to the employee together with the right of appeal. If the employee appeals there must be a further meeting. The statutory procedure is a minimum

 

 

requirement and even where the relevant statutory procedure is followed the dismissal may still be unfair if the employer has not acted reasonably in all the circumstances.

 

75. Article 130(1) ERO provides that in determining for the purposes of this part whether the dismissal of an employee is fair or unfair, it is for the employer to show:-

 

(a) the reason (or, if more than one, the principle reason) for the dismissal, and

 

(b) that it is either a reason falling within Paragraph (2) or some other substantial reason of a kind such as to justify the dismissal of an employee holding the position which the employee held.

 

Reasons falling within Paragraph (2) include at Article 130(b) if it relates to the conduct of the employee.

 

76. Under Article 130(4) ERO where the employer has fulfilled the requirements of Paragraph (1), the determination of the question whether the dismissal is fair or unfair (having regard to the reason shown by the employer):-

 

(a) depends on whether in the circumstances (including the size and administrative resources of the employer's undertaking) the employer acted reasonably or unreasonably in treating it as a sufficient reason for dismissing the employee, and

 

(b) shall be determined in accordance with equity and the substantial merits of the case.

 

77. It is well established that the approach the tribunal should take in deciding whether an employer acted reasonably in treating an employee's conduct as a sufficient reason for dismissal is set out in the case of Iceland Frozen Foods  v  Jones [1983] ICR17, such that:-

 

1. The starting point should always be the words of Article 130(4).

 

2. In applying the Article an industrial tribunal must consider the reasonableness of the employer's conduct, not simply whether they (the members of the industrial tribunal) consider the dismissal to be fair.

 

3. In judging the reasonableness of the employer's conduct an industrial tribunal must not substitute its decision as to what was the right course to adopt from that of the employer.

 

4. In many, though not all cases, there is a band of reasonable responses to the employee's conduct within which one employer might reasonably take one view and another quite reasonably take another.

 

5. The function of the industrial tribunal, as an industrial jury, is to determine whether in the particular circumstances of each case the decision to dismiss the employee fell within the band of reasonable responses which a reasonable employer might have adopted, if the dismissal falls within the band the dismissal is fair, if the dismissal falls outside the band it is unfair.

 

78. This approach was endorsed by the Northern Ireland Court of Appeal in Rogan V South Eastern Health and Social Care Trust [2009] NICA 47 and Dobbin V Citybus Limited [2008] NICA 42.

 

79. In Bowater V North West London Hospitals NHS Trust [2011] EWCA Civ 63 the Court of Appeal reiterated that the Tribunal must not substitute its own view for that of the employer, the test to be applied is whether the decision to dismiss was within the band of reasonable responses open to a reasonable employer.

 

80. In the context of a misconduct case Arnold J in British Home Stores  v Burchell [1980] ICR303 stated:

" What the tribunal have to decide every time is, broadly expressed, whether the employer who discharged the employee on the grounds of the misconduct in question (usually, though not necessarily, dishonest conduct) entertained a reasonable suspicion amounting to a belief in the guilt of the employee of that misconduct at that time. That is really stating shortly and compendiously what is in fact more than one element. First of all, there must be established by the employer the fact of that belief; that the employer did believe it. Secondly, that the employer had in his mind reasonable grounds upon which to sustain that belief. And thirdly, we think, that the employer, at the stage at which he formed that belief on those grounds, at any rate at the final stage at which he formed that belief on those grounds, had carried out as much investigation into the matter as was reasonable in all the circumstances of the case. It is the employer who manages to discharge the onus of demonstrating those three matters, we think, who must not be examined further.

 

It is not relevant, as we think, that the tribunal would themselves have shared that view in those circumstances. It is not relevant, as we think, for the tribunal to examine the quality of the material which the employer had before them, for instance, to see whether it was the sort of material, objectively considered, which would lead to a certain conclusion on the balance of probabilities, or whether it was the sort of material which would lead to the same conclusion only upon the basis of being 'sure', as it is now said more normally in a criminal context, or, to use the more old-fashioned term, such as to put the matter 'beyond reasonable doubt'. The test, and the test all the way through, is reasonableness; and certainly, as it seems to us, a conclusion on the balance of probabilities will in any surmisable circumstances be a reasonable conclusion".

 

81. The band of reasonable responses test applies not just to the decision to dismiss but also to the procedure followed by the employer ( Whitebread plc v Hall [2001] ICR699), in misconduct cases this includes the investigation, findings and conclusions ( Cossington v C2C Rail Ltd [2013] UKEAT/0053/13). An employer must carry out a reasonable investigation. A consideration as to whether a particular investigatory step was required or not is whether the employee asked for it to be taken ( Stuart v London City Airport UKEAT/0336/12/SM). The degree of investigation will depend on the seriousness of the allegation and higher degree of investigation may be required where the employee's integrity is in question or dismissal could end their future career in their chosen profession ( Salford Royal NHS Foundation Trust v Roldan [2010] ICR 1457). It is inappropriate to require the safeguards of a criminal trial however investigation should include consideration of evidence which might potentially be viewed as exculpatory ( A v B [2003] IRLR 405). It is not for a tribunal to decide what investigations would have been appropriate in light of evidence heard at hearing but to ask was further investigation required to satisfy the requirements of fairness.

82. Taylor v OCS Group Ltd [2006] IRLR 613 CA provides authority that procedural defects in the initial disciplinary hearing may be remedied on appeal provided that in all the circumstances the later stages of the procedure are sufficient to cure the earlier unfairness. It is for the tribunal to consider whether the overall process was fair, notwithstanding deficiencies at an early stage, in particular giving consideration to the thoroughness and open-mindedness of the decision maker.

 

83. The Labour Relations Agency Code of Practice on dealing with disciplinary and grievance issues sets out what constitutes good employment practice and reasonable behaviour for both employers and employees. The Code sets out at:

 

Paragraph 9. When a potential disciplinary matter arises, the employer should make necessary investigations to establish the facts promptly before memories of events fade. It is important to keep a written record for later reference.

 

Paragraph 15. The first step in any formal process is to let the employee know in writing the nature of what they are alleged to have done wrong. The letter or note setting out the allegation can also be used to explain the basis for making the allegation. It is important that an employee is given sufficient information to understand the basis of the case against them.

 

Paragraph 18. At the meeting the employer should begin by restating the complaint against the employee and going through the evidence that has been gathered. The employee should be allowed to set out his/her case and answer any allegations that have been made. The employee should also be allowed to ask questions, present evidence, call witnesses and be given an opportunity to raise points about any information provided by witnesses. However, this does not mean that witnesses will normally be subject to cross-examination in the disciplinary hearing.

 

Paragraph 38. If an employer considers an employee guilty of gross misconduct and potentially liable for summary dismissal, it is still important to establish the facts before taking any action. A short period of suspension with full pay may be helpful or necessary, although the suspension should be imposed only after careful consideration and should be kept under review. It should be made clear to the employee that the suspension is not a disciplinary action and does not involve any prejudgement.

 

Paragraph 63. When drawing up and applying procedures employers should always bear in mind the requirements of natural justice. This means that, where possible, employees should be given the opportunity of a meeting with someone who has not been previously involved in the process. They should be informed of the allegations against them, together with the supporting evidence, in advance of the meeting. Employees should be given the opportunity to challenge the allegations before decisions are reached and should be provided with a right of appeal. (Emphasis added).

 

84. It is important therefore for the tribunal to remember that it has a limited jurisdiction in relation to claims of alleged unfair dismissal. It may not rehear and re-determine the disciplinary decision originally made by the employer; it cannot substitute its own decision for the decision reached by that employer. In the case of a misconduct dismissal, such as the present case, the tribunal must first determine the reason for the dismissal: that is, whether in this case the dismissal was on the basis of conduct and must determine whether the employer believed that the claimant had been guilty of that misconduct. The tribunal must then consider whether the employer had conducted a reasonable investigation into the alleged misconduct and whether the employer had then acquired reasonable grounds for its belief in guilt; not whether the tribunal would have reached the same decision on the same evidence or even on different evidence. The tribunal must then consider finally whether the decision to dismiss was proportionate in all the circumstances of the case.

 

APPLICATION OF THE LAW TO THE FACTS FOUND

 

Taking into account the claimant's and respondent's submissions:

 

85. No submissions were made that the dismissal was automatically unfair for failure to complete the SDP, nor that dismissal was outside the band of reasonable responses for a reasonable employer in all the circumstances. We find that the standard SDP applied and overall was completed.

86. We find that the respondent's genuine reason for the claimant's dismissal related to conduct. Misconduct is a potentially fair reason for dismissal.

 

87. We are of the view that both on conclusion of the disciplinary and more importantly appeal stage when the dismissal decision was upheld, which is the relevant point in time for our consideration, that the respondent held a genuine belief that the claimant was guilty of the alleged misconduct. The tribunal must then consider whether the respondent had conducted a reasonable investigation and whether the respondent had then acquired reasonable grounds for the belief in guilt, applying the reasonable band test. In doing so we note in particular the following:

 

88. If an employer considers an employee guilty of misconduct it is still important to establish the facts before taking action. The investigatory process is important to in particular enable an employer to discover relevant facts to allow him to reach a decision whether an offence has been committed. The proper conduct of the disciplinary process secures fairness to the employee by allowing an opportunity to respond to allegations made and to raise any relevant substantive defence. It is for an employer to make appropriate enquiries and not to form their belief hastily or to act hastily. We reject the respondent's submission that the two offers of money by the claimant to Mr Collins understood by him to be bribes were tantamount to a confession, we note in particular Mr Collin's evidence that the investigation had not concluded prior to the disciplinary meeting and furthermore that the claimant made his comments without any formal notification by the respondent of an investigation into suspected misconduct and we consider that it in the circumstances was not within the reasonable band test to rely upon the comments as an admission of guilt so as to discharge the need to reasonably investigate.

 

89. Mrs Shanks as per her own evidence did not understand IT, was heavily reliant upon Mr Collins and was clearly confused by the evidence gathered and provided by him, in particular of note Mrs Shanks contrary to the evidence of Mr Craigs stated that remote access had been discussed and explained to her by Mr Craigs before going into the meeting with the claimant on 12 May 2016 and furthermore that she had seen evidence of remote access by the claimant and wrongly identified at hearing screenshots of computer activity, whereas in fact no evidence of remote access logs were provided at any stage. We consider that from the outset and while investigation into the matter was ongoing before facts were established that both Mrs Shanks and Mr Craigs appear to have already formed a view that the claimant was guilty, supported by Mrs Shanks comment to the claimant on
12 May 2016 that if he admitted to the matter it would be a warning but otherwise would be more serious and Mr Craig's comment at the disciplinary hearing ' don't throw the innocent card'.

 

90.          The investigation into the alleged misconduct as per Mr Collin's evidence had not concluded but was ongoing at the stage of the disciplinary hearing. The claimant was still being provided additional relevant documentation on the day of the disciplinary meeting with little if any time to consider it. We note that that the claimant was keen and indeed pressed for the disciplinary meeting to take place quickly believing that he would be vindicated on showing that activity on the server had taken place at times when he was not present in the office. The respondent prior to the disciplinary meeting had already noted that activity had occurred outside working hours and had checked alarm records to ensure that the premises has not been entered. The claimant was not however made aware as part of the case against him that remote access was a constituent element until he brought up times and dates in the course of the disciplinary meeting and no supporting evidence for remote access was provided in advance to the claimant nor thereafter despite the claimant's denial of having remotely accessed the server and his repeated requests for supporting evidence.

 

91. We accept that Mrs Shanks, whilst not having chaired the disciplinary meeting, was present throughout it and as such this situation different to those contemplated by the EAT in Budgen & Co v Thomas [1976] ICR 344. The disciplinary meeting was not well controlled throughout by Mr Craigs who by his own admission was not ' au fait' with IT. Mr Craigs allowed Mr Collins to take over in questioning and putting the case against the claimant resulting in numerous heated exchanges between the claimant and Mr Collins. Mr Collins, over whom the claimant had raised concern with Mrs Shanks as to his capability on 13 May 2016 was unwilling or unable to answer all of the questions put by the claimant despite his role to be there as an independent expert to answer questions from both parties and repeatedly stated that the claimant could get his own expert in to prove or disprove matters. Both
Mr Craigs and Mrs Shanks acknowledged at hearing that Mr Collins had not answered the claimant's questions. Without recourse then to an independent IT expert to deal with the potential exculpatory evidence referred to by the claimant and which Mr Collins had indicated the claimant could get a third party to address and indeed as per Mr Collin's evidence at hearing, that he had advised the respondent to do, albeit not his decision to make; or the respondent consulting the claimant's two colleagues as requested by the claimant regarding the alleged bribe,
Mrs Shanks on Mr Craig's recommendation proceeded without further investigation to reach a conclusion of guilt and decision to dismiss. We consider that further investigation was clearly required before making a decision in these circumstances so as to satisfy the requirements of fairness.

 

92. Mr Craigs informed the claimant at the disciplinary outcome meeting that he could get his own expert in at the appeal stage. Mr Wilson may not have been the ideal choice as chairperson for the appeal hearing given his business and social connections with the respondent but we accept this was overall negated by his being assisted by an independent HR consultant Mrs Dael. Although Mrs Shanks put to the claimant in her correspondence of 3 June 2016 that no additional information would be considered at the appeal this was later countered by her letter of 6 June 2016 and Mr Wilson's of 9 June 2016 assuring the claimant otherwise. On balance we are not persuaded that the appeal process was significantly limited in its remit by Mrs Shanks, was prejudiced or a sham. However, whilst the appeal stage was an opportunity to remedy prior flaws and the need for further investigation indeed identified; one of the claimant's two colleagues, Ms McCormick who actually overheard part of the telephone call on 12 May 2016 was interviewed; and an independent expert consulted, there were also flaws in the appeal procedure. Potentially significant information put to Mr Eccles by Mrs Dael was incorrect and appeal points raised by the claimant were not addressed, as acknowledged by Mr Wilson in his evidence, in addition the claimant's request for a third party to look at the matter was not facilitated and the claimant's request for
Mr Bentley to attend the appeal hearing as an expert witness was refused by the appeal panel contrary to repeated suggestion by Mr Collins at the earlier disciplinary meeting and the assurance by Mr Craigs at the disciplinary outcome meeting that the claimant could bring in his own expert, even though the claimant's letter expressing disappointment and his comments at the outset of the appeal hearing made clear that Mr Bentley's attendance was intended to be as an expert witness rather than statutory companion. As such we do not consider that the appeal process was sufficiently thorough or procedurally fair so as to successfully cure defects in the earlier stage, in particular by reason of denying the claimant the promised opportunity to bring in his own expert.

 

93.          An investigation is not expected to have the safeguards of a criminal trial and the size and administrative resources of the respondent's undertaking is a relevant factor, however the conduct alleged, by way of remote access of a server without permission, was potentially of a criminal offence and we accept its seriousness and potential effect on the claimant's future employment, together with the investigatory steps specifically requested by the claimant despite the small size of the respondent's business required careful and conscientious investigation to include consideration of potential exculpatory evidence and that the above flaws were not attributable to size or administrative resources.

 

94.          Arising out of the above circumstances and taking into account rules of natural justice together with the requirements of the LRA Code at paragraphs 9, 15, 18, 38 and 63 we consider overall that the investigation carried out into the alleged misconduct and procedures adopted by the respondent fell outside the reasonable band test. The respondent has not conducted a reasonable investigation and the Burchell test is not met.

 

SUMMARY CONCLUSION

 

95.          We find in the circumstances that the respondent acted unreasonably in treating the alleged misconduct as a sufficient reason for dismissing the employee and the respondent's dismissal of the claimant was unfair under Article 130 ERO.

 

THE LAW RELEVANT TO REMEDY

 

96.          Where a tribunal finds the grounds of complaint of unfair dismissal are well- founded the Orders it may make are set out at Article 146 ERO and include reinstatement, re-engagement and otherwise compensation. How compensation is to be calculated is set out in Articles 152 to 161 ERO. The starting point for the calculation of the compensatory award is Article 157 (1) ERO:

 

(1) Subject to the provisions of this Article and Articles 158, 160 and 161, the amount of the compensatory award shall be such amount as the tribunal considers just and equitable in all the circumstances having regard to the loss sustained by the complainant in consequence of the dismissal in so far as that loss is attributable to action taken by the employer'.

 

97.          The compensatory award should not be increased out of sympathy for the claimant or to express disapproval of the respondent. The claimant has a duty to mitigate his loss and the onus is on the respondent to show the claimant as unreasonable in the steps taken or not taken to do so. The compensatory and basic awards may be reduced where the claimant was guilty of blameworthy conduct (i.e. perverse, foolish, 'bloody-minded' or unreasonable in the circumstances) that contributed to the employer's decision to dismiss and the tribunal considers it just and equitable to reduce the award by a percentage to reflect the extent of the contributory fault.

 

98.          The case of Polkey v Dayton Services LTD 1987 3 All ER 974 HL makes it clear that, if a dismissal is procedurally defective, then that dismissal is unfair but the tribunal has a discretion to reduce any compensatory award by any percentage up to 100% if following the procedures correctly would have made no difference to the outcome.

 

FINDINGS RELEVANT TO REMEDY ONLY

 

99.           The claimant sought compensation only.

 

100.        The effective date of termination (EDT) was 19 May 2016. The claimant was aged 30 at that date and had one full years' service. His gross weekly pay was £365.38 and net weekly pay £311.54.

101.        The claimant in relation to the telephone call with Mr Collins on 12 May 2016 was aware and conveyed to Ms McCormack that Mr Collins had been taking the gambling matter seriously whereas the claimant was joking and despite
Ms McCormick's recommendation that he phone Mr Collins back to clarify with him that he was joking, the claimant did not do so. The two approaches by Mr Collins in response to which the claimant said he would pay Mr Collins money to keep quiet contributed significantly to the respondent's conclusion that the claimant had in fact offered a bribe to Mr Collins and significantly to the decision to dismiss.

 

102.       The claimant has made 69 job applications and registered with 9 recruitment agencies in an attempt to find other work between his dismissal and date of hearing.

 

103.       No submissions were made in respect of Polkey.

 

104.       The claimant sought costs of £700 paid to JCB Consulting Services Ltd made up of £400 for Mr Bentley's evidence report dated 18 November 2016 and £300 for
Mr Bentley's attendance at hearing.

 

105.       Taking into account the above we are not persuaded that if correct procedures had been followed in respect of the misconduct alleged that the claimant would have been dismissed in any event such that a Polkey reduction is appropriate. We are however of the opinion that the claimant's behaviour in responding to Mr Collins a second time offering him a cut of his winnings to keep quiet although being aware on Mr Collin's second enquiry that Mr Collin's was being serious and despite advice from his colleague to phone back to clarify this, not to do so, particularly in light of the recent ransomware attack suffered by the respondent was foolish and unreasonable in the circumstances. We find in the circumstances the claimant was guilty of blameworthy conduct that heavily contributed to the respondent's decision to dismiss and find that it is just and equitable to make a 50% reduction in the basic and compensatory awards to reflect this.

 

106.       We accept that Mr Bentley was not instructed by the claimant prior to the appeal hearing, that his report was not provided to the appeal panel and that his evidence was largely irrelevant to the proceedings and did not form part of the decision to dismiss and on this basis reject the claimant's application for costs of £700 in relation to Mr Bentley's report and attendance at hearing.

 

107.       Taking into account the above, we award the following:

 

(1)           Basic Award - under Article 153 ERO :-

 

£365.38 x 1 x 1 = £365.38

 

 

(2)           Compensatory award - under Article 157 ERO:-

 

(i)         Loss of earnings EDT to date of hearing:

Say, 37 weeks SSP @ £311.54 £11,526.98

 

(ii)        Future loss, say 24 weeks @ £311.54 £ 7,476.96

 

(iii)       Loss of statutory rights, say £ 300.00

£19,303.94

 

Less 50% deduction for contributory fault - £ 9,651.97

 

Total compensatory award £ 9,651.97

 

Total Unfair Dismissal Compensation £10,017.35

 

 

RECOUPMENT

 

108.        The following particulars are given pursuant to the Employment Protection (Recoupment of Jobseeker's Allowance and Income Support) Regulations (Northern Ireland) 1996; The Social Security (Miscellaneous Amendments No. 6) Regulations (Northern Ireland) 2010 and your attention is drawn to the attached notice:

 

(a) Monetary award £10,017.35

 

(b) Prescribed element £5,763.49

 

(c) Period to which (b) relates: 19 May 2016 - 7 February 2017

(d) Excess of (a) over (b) £4,253.86

 

 

CONCLUSION

 

109.        The claimant has been unfairly dismissed by the respondent contrary to Article 130 ERO and respondent shall pay the claimant compensation of £10,017.35.

 

110.        This is a relevant decision for the purposes of the Industrial Tribunals (Interest) Order (Northern Ireland) 1990.

 

 

Employment Judge:

 

Date and place of hearing: 24, 25, 27 January & 7 February 2017, Belfast

 

 

Date decision recorded in register and issued to: