United Kingdom Employment Appeal Tribunal

APPEARANCES

 

For the Appellant	MR KAUSHIK CHAUDHURI (Consultant) Instructed by: Lloyds Employment Law Consultancy Ltd Lloyds House 2 West Street Bourne Lincs PE10 9NE
For the Respondent	MR MALCOLM GLAZIER (Consultant) Instructed by: Employment Law Advisory Service Lancaster House Old Wellington Road Eccles Manchester M30 9QG

SUMMARY

Public Interest Disclosure

Protected Disclosure. Employer deliberately broke into computer system to show that his concerns that information might be obtained in breach of the Data Protection Act was reasonable. Disciplined for that reason and resigned in protest and being disciplined. Was it a protected disclosure? Was there a constructive dismissal? If so, was automatically or unfair or in any event unfair under general unfair dismissal principles?


 


THE HONOURABLE MR JUSTICE ELIAS

1. This is an appeal from the decision on liability promulgated on 4 April 2005 in which the Employment Tribunal sitting in Manchester unanimously held that the Claimant, the Respondent to this appeal, had been unfairly from Bolton School for having made a protected disclosure contrary to section 103A of the Employment Rights Act 1996 and had suffered a detriment by reason of making a protected disclosure contrary to section 47B of that Act. It also found that even if the dismissal were not automatically unfair, it was nevertheless unfair under general unfair dismissal law.
2. In the subsequent remedies hearing the Tribunal made an award of compensation of £26,118.13 which included an award of £3,000 for injured feelings resulting from the detriment imposed in breach of section 47B. Shortly after that hearing the Tribunal became aware that there was a decision of this Tribunal in Melia v Magna Kansei Ltd [2005] IRLR 449, Burton J presiding, which appeared to affect its award of compensation. In that case this Tribunal held that the effect of section 47B(ii) (set out below) was that where a course of conduct causes an employee to leave and claim constructive dismissal, any compensation must be limited to the loss flowing from the dismissal itself, and the employee cannot claim that the conduct which brought about his resignation constitutes an independent detriment justifying a separate and independent claim to compensation under section 47B.
3. The effect of this was that the award of £3,000 for injury to feelings could not stand. The compensation had to be limited to the loss flowing from the dismissal and, following Dunnachie v Kingston upon Hull City Council [2004] IRLR 727, no such compensation can be awarded in an unfair dismissal case. At the behest of the school, the Tribunal carried out a review of its original remedies decision. It concluded that the £3,000 could no longer stand because there were no other detriments imposed prior to the dismissal, save for the warning.
4. Since the Tribunal's review decision, the Court of Appeal has reversed the EAT. (See Melia v Magna Kansei Ltd [2006] IRLR 117). It was not persuaded by the reasoning of this Tribunal and held that it was possible, in cases such as this, to make separate claims for any detriment suffered prior to termination under section 47B, together with an independent claim under section 103A in respect of the dismissal itself. Chadwick LJ summarized the principle as follows:

"When the two sections are read together, the proper meaning to be given to the phrase "the detriment in question amounts to dismissal" is that it excludes detriment which can be compensated under the unfair dismissal provisions. If the detriment cannot be compensated under the unfair dismissal provisions – for the reason that it is not a loss sustained in consequences of the dismissal – then there is nothing to take it out of section 47(B); and the provisions in section 49, which require compensation for that detriment, should apply"

5. It follows that the finding of breach of section 47B, in addition to the finding of automatic unfair dismissal, stands. We understand that the Employment Tribunal has agreed to review the level of compensation in the light of the Court of Appeal's decision.
6. We turn now to the facts of this case.
7. The Claimant was employed by the school as a technology teacher in the Information and Communication Technology (ICT) Department. He was employed from 1 May 1996 until 2 December 2003. He resigned giving 2 months notice to the school on 2 October 2003. He gave as his reason for resignation the fact that he had "sought to highlight serious failings of the new computer system"
8. The new computer system had been the subject of much debate and deliberation within the school. An ICT project group had been set up to implement a strategic plan which had obtained the approval of the school governors. There were various meetings of that group between May 2002 and June 2003. It is common ground that the Claimant became involved with that group. He was not a formally constituted member but he was technically proficient, was very well versed in ICT matters, and was motivated, as was recognised by the School, to try and ensure that the system adopted was appropriate.
9. The Claimant expressed concerns that security issues were not being satisfactorily addressed. The proposed strategy involved consolidating four separate networks into a single platform. The effect of this is that the same system would be used for educational purposes by the pupils and for administrative purposes by members of staff for record keeping including maintaining the records of personal pupils.
10. These concerns of the Claimant were shared by the head of his department, Dr Watson, who strongly urged the adoption of two entirely separate ICT networks because of security risks. The particular risk was the possibility that pupils might hack into the confidential information stored on the same server to which they would have access under a single platform. There were debates within the project group as to the appropriate network to adopt. Some preferred the Linux network (including the Claimant), others preferred Microsoft Windows. That system was ultimately chosen because it was thought that pupils would be more likely to use it in their homes. It was also, however, thought appropriate to have a security system and the measure adopted was known as 'Virtual LAN (Local Area Network) segregation'
11. It was believed that this would restrict access by pupils to the computers being used by staff. This was not in fact the Claimant's preferred method of security; he would have chosen the physical segregation of the hardware, as would Dr Watson. The Tribunal found that although unhappy with the decisions made, the Claimant recognised that it was the school's choice.
12. When the new system was being installed in the summer holidays of 2003 it transpired that the state of the cabling was different than had been anticipated. It had been thought that there had been separate cabling of the student and staff networks. In fact, however, it was discovered that there were already just one set of cabling for both. So the head of the project group, Mr Marsden, took the decision not to implement the virtual LAN segregation at all. He reasoned that there had been no security breaches even when the networks were physically inter-related and, therefore, some lesser form of security would suffice. He considered that password security would be adequate.
13. The Claimant was informed about this when he returned to school on 1 September 2003. He was concerned that the security protection was inadequate. He wished to demonstrate the inadequacy of the system. Accordingly, on 5 September, he went to the learning centre and used a PC to which students will have access and adopted a technique which enabled him to gain access to the encrypted passwords for the PC and then save them to a floppy disc which he could take away. He said that this task took him no more than 10 minutes.
14. Later on that day, 5 September, he told Mr Edmundson that he was attempting to gain access to the system in order to test security and to demonstrate what he perceived to be its failings. Mr Edmundson was the member of staff who had been designated by the headmaster, Mr Brooker, to be the individual who should be contacted if there were concerns about the IT network. The Claimant also discussed potential security weaknesses with Mr Humphreys, who was head of computing in the school. The Claimant told Mr Humphreys that he thought he would be able to gain access to information which ought to be limited only to staff members. Mr Humphreys told him to consult with Mr Edmundson. The Claimant said that he had already done that. Mr Humphreys was content for the Claimant to undertake a simple test to see if he could gain administrative access from resources available to pupils.
15. The Tribunal also found that there were somewhat ambiguous instructions as to whether or not staff could test the system. Apparently, it had happened on occasions in the past. Armed with a floppy disc which he had acquired on 5 September, the Claimant set about decoding the passwords over the weekend of 6 and 7 September. He admitted to having engaged the assistance of a former pupil at the school when carrying out that task.
16. He returned to the school on the Monday morning and gained access to the system from a student PC in the technology department and disabled some of the user accounts for the ICT services department, which was a non-teaching department within the school. He did not affect any data on the system and teachers and staff were still able to have access to the computer. He then informed Mr Edmundson of what he had done and told other staff members, including Mr Humphreys and other ICT staff.
17. He knew that ICT services would not be able to gain access to the system but he did not mention it to them. The Tribunal found that there was indeed considerable friction between the Claimant and Mr Fox, who was the head of ICT services. At 10.25am that morning the Claimant told the headmaster, Mr Brooker, what he had done. But the headmaster appeared somewhat distracted, no doubt understandably on the first week of a new academic year, and advised the Claimant to see Mr Edmundson.
18. He was then requested by Mr Humphreys to demonstrate how he had accessed the system. At this stage, ICT services shut down the entire network. They suspected, correctly of course, that someone had hacked into the system. The Claimant considered this to be a panic reaction for ICT services were unwilling to take risks. The school says that the financial losses caused by the Claimant's actions are in the region of £1,000. The ICT services team spent, apparently, some hours that day reinstating the system.
19. On 9 September Mr Brooker carried out an investigation. He interviewed various people including Mr Fox and Mr Humphreys and he called the Claimant to an investigatory meeting. There was a disciplinary hearing on 11 September 2003. The Tribunal formed the impression that Mr Brooker had already made up his mind that the Claimant had committed an act of misconduct. At the outset, Mr Brooker told the Claimant that the Claimant had deliberately hacked into the network without authority as a pre-meditated act.
20. The Tribunal observed that the headmaster had not actually interviewed Mr Edmundson who the Claimant was stating had sanctioned his actions. The Tribunal pointed out, and we agree, that the duty on an employer in conducting an investigation is to get to the truth of the matter and no employer should refuse to entertain evidence that potentially may be of benefit to the employee. We do not suggest that Mr Brooker deliberately did not interview Mr Edmundson in order to distort the evidence, but that may well have been the effect.
21. The headmaster reached the decision that the Claimant had deliberately hacked into the network. He accepted that the Claimant was acting in good faith. Indeed he also conceded before the Tribunal that the Claimant may have been justified in his belief that he was not being properly listened to in relation to his security concerns. Mr Brooker issued a written warning. The Claimant appealed and that appeal was heard by the Vice-Chairman of the Governors, Mr Leigh-Bramwell.
22. The Claimant contended on appeal that he had authority to do what he did, that he had acted in good faith, having genuine concerns about the security issues, and that he felt he was being disciplined for drawing the Respondent's attention to breaches of the Data Protection Act 1998. Specifically, he was concerned about the breach of the seventh Data Protection principle set out in schedule 1, part 1 of the Data Protection Act 1998 which is as follows:

"Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to personal data."

He thought he had been subjected to a detriment, namely the warning, by reason of making a qualifying disclosure and that this was contrary to section 47(B) of the Employment Rights Act 1996.

23. The Tribunal found that Mr Leigh-Bramwell conducted a very thorough investigation. He did obtain the views of Mr Edmundson who confirmed that he did indeed know that the Claimant was intending to test the system in order to establish its security vulnerability. Mr Edmundson did not however believe that he had authority to give specific approval for these actions but he accepted that the Claimant might have thought otherwise. Mr Humphreys accepted that he had given implicit approval by not stopping the Claimant from carrying out the tests. Dr Watson considered that it was desirable that the tests should be carried out by somebody outside a technical team in order to make it sufficiently rigorous. Mr Leigh-Bramwell also obtained notes from his discussions with members of staff but they were not shown to the Claimant at the Appeal.
24. The appeal was dismissed on 1 October. Mr Leigh-Bramwell took the view that Mr Edmundson had not appreciated the nature of the tests needed to be carried out and he was critical of the Claimant for having involved a third party in his hacking activities over the weekend of 6 and 7 September. He also rejected the contention of the disciplinary warning had been imposed because the Claimant had made a public interest disclosure.
25. On the following day Mr Brooker invited the Claimant to discuss matters further but the Claimant took the view that his position was untenable and he resigned, as we have said, on 2 October. He felt he had been victimized for highlighting security concerns and he was aggrieved that the school had focused on his conduct rather than tackling what he considered to be the much more important question of why the system had been established in what he perceived to be an insecure way.

The Law

26. In order to understand the issues in this case it is necessary to set out certain relevant statutory provisions.

Employment Rights Act 1996 Section 43A:

"43A Meaning of "protected disclosure"

In this Act a "protected disclosure" means a qualifying disclosure (as defined by section 43B) which is made by a worker in accordance with any of sections 43C to 43H."

Section 43B:

"43B Disclosures qualifying for protection

(1) In this Part a "qualifying disclosure" means any disclosure of information which, in the reasonable belief of the worker making the disclosure, tends to show one or more of the following

(a) that a criminal offence has been committed is being committed or is likely to be committed,

(b) that a person has failed, is failing or is likely to fail to comply with any legal obligation to which he is subject,

(c) that a miscarriage of justice has occurred is occurring or is likely to occur,

(d) that the health or safety of any individual has been, is being or is likely to be endangered,

(e) that the environment has been, is being or is likely to be damaged, or

(f) that information tending to show any matter falling within anyone of the preceding paragraphs has been, or is likely to be deliberately concealed…

(3) A disclosure of information is not a qualifying disclosure if the person making the disclosure commits an offence by making it…

(5) In this Part "the relevant failure", in relation to a qualifying disclosure, means the matter falling within paragraphs (a) to (f) of subsection (1 )."

Section 43C sub-section 1:

"43C Disclosure to employer or other responsible person

(1) A qualifying disclosure is made in accordance with this section if the worker makes the disclosure in good faith

(a) to his employer, or

(b) where the worker reasonably believes that the relevant failure relates solely or mainly to

(i) the conduct of a person other than his employer, or

(ii) any other matter for which a person other than his employer has legal responsibility,

to that other person."

Section 47B:

"(1) A worker has the right not to be subjected to any detriment by any act, or any deliberate failure to act, by his employer done on the ground that the worker has made a protected disclosure.

(2) ...this section does not apply where

(a) the worker is an employee, and

(b) the detriment in question amounts to dismissal (within the meaning of [Part X]).

(3) For the purposes of this section, and of sections 48 and 49 so far as relating to this section, "worker", "worker's contract", "employment" and "employer" have the extended meaning given by section 43K."

Section 103A:

"103A Protected disclosure

An employee who is dismissed shall be regarded for the purposes of this Part as unfairly

dismissed if the reason (or, if more than one, the principal reason) for the dismissal is that the employee made a protected disclosure."

27. The basic scheme is tolerably clear. If the employee makes a disclosure in good faith to his employer of relevant qualifying information then provided he is not committing a criminal offence in making the disclosure he is protected from dismissal and detrimental action short of dismissal. The information may in fact be inaccurate or wrong that does not move the protection provided the employee has a reasonable belief that the information tends to show one or more of the matters set out in section 43(1)(B). (See the observations of this Tribunal in Darnton v University of Surrey [2003] IRLR 133).

The Tribunal hearing

28. The Claimant submitted before the Tribunal that the warning constituted a detriment, that it had been imposed contrary to Section 47B because he had made a public interest disclosure; that the imposition of the warning in those circumstances amounted also to a breach of the duty of trust and confidence; and that he had resigned in response to that breach. It followed, he submitted, that he had been automatically unfairly dismissed contrary to Section 103A of the Employment Rights Act 1996. Alternatively, he claimed that in any event, even if section 103A were not applicable, he had been unfairly dismissed within the meaning of Section 198 of that Act.
29. The School responded with a battery of arguments, only some of which are now the subject of appeal. They fell into three main categories. First, the School submitted that even if there was a dismissal, it was not by reason of any protected disclosure at all. There were a number of limbs to this argument. It was said that nothing had been disclosed which fell within the terms of Section 43B at all. Further, it was alleged that the Claimant did not reasonably believe that the School was failing or likely to fail to comply with any legal obligation. Then it was said that any disclosure was not made in good faith; it was made to prove that the Claimant was right about the inadequacy of the system rather that to highlight that problem.
30. Second, the School also submitted that even if the Claimant had made a protected disclosure, the reason for the dismissal was his misconduct in hacking into the system and this was wholly unconnected with any such disclosure as there was. In any event, if that was a disclosure, he had committed a criminal offence in the course of it, namely a breach of the Computers Misuse Act 1990 when he hacked into the system.
31. Finally, the School denied that there had been any dismissal at all. It was denied that the disciplinary warning was unwarranted or unlawful. On the contrary, it was said that the employers had every reason to discipline for a clear act of misconduct as the Claimant had knowingly, deliberately and without authority broken into their computer system. Such justified disciplinary action did not, and could not, said the School amount to a breach of the duty of trust and confidence. Accordingly, the employee had resigned and had not been dismissed.
32. The Tribunal concluded that the Claimant had made a qualifying disclosure, namely that he had reasonably believed that the information tended to show that the Respondent had failed, or was likely to fail, in its obligations under the Data Protection Act 1998. They were also satisfied that it was made in good faith. The Tribunal did not accept that the conduct in breaking into the computer system should be seen as distinct from the actual disclosure of information itself; it was so interrelated to the disclosure that it should be considered to be part and parcel of it, and it attracted the same protection. Moreover, the Claimant did not lose that protection on the grounds that he committed an offence because the Computer Misuse Act only established criminal liability for unauthorized access to computers, and the Tribunal found that he was in fact authorized.
33. Accordingly, although the Tribunal accepted that the warning had been given because of his having hacked into the computer, that amounted in the Tribunal's view to a protected disclosure. The employers had acted in breach of the duty of trust and confidence by acting as they did; the subsequent resignation of the Claimant, therefore, amounted to a dismissal. The Tribunal also held that independently of the protected disclosure provisions, the dismissal was unfair under general principles of unfair dismissal law. The procedures had been inadequate. Although the School genuinely believed the Claimant had committed an act of misconduct, it did not reasonably hold that belief after having carried out a reasonable investigation. It did however, find that the Claimant had been less than wholly frank with Mr Edmundson about what he intended to do and what were the implications of his proposed testing of the system. And it held that he was wrong to have involved a third party in his activities over the weekend of 6 and 7 September. For those reasons it considered he had contributed to his own dismissal to the extent of 25 percent.

The Grounds of Appeal

34. Certain findings of the tribunal have not been appealed. It is not now contended, that any disclosure was not made in good faith, nor that any criminal offence was committed by the Claimant in making the disclosure. Nor is the finding of unfair dismissal under Section 98 challenged directly, although it is alleged that if the finding on protected disclosure is unwarranted, then the basis on which the Tribunal found that there had been a constructive dismissal is fatally undermined.
35. The School do contend that the Tribunal erred in law in holding that they infringed section 47B in giving the warning and concluding that the consequential dismissal was unlawful, being contrary to Section 103A. The School before us now advance three grounds of appeal. The first is that the Tribunal failed properly to identify the nature of the qualifying disclosure allegedly made, and that when properly analyzed, the evidence does not establish that there was the disclosure of any information which could be said to amount to a protected disclosure.
36. Second, it is alleged that the Tribunal concluded that the Claimant had reasonably believed that the information tended to show that there was likely to be a breach of a legal obligation (namely that under the Data Protection Act) without a proper consideration of what that legal obligation entailed. It is submitted that had the Tribunal properly considered the precise scope of the obligation, it could not have concluded that the employee had reasonably formed his belief at all. There was no evidence that he understood the full nature in scope of that obligation.
37. Finally, it is submitted that even if there were some protected disclosure, the Tribunal erred in law in treating the activities of the Claimant in hacking into the system as being an aspect of that disclosure which attracted the same protection as the specific disclosure of information itself. This raises a question of some importance relating to the scope of the concept of disclosure.
38. We deal with these issues in turn.

Was there any qualifying disclosure at all?

39. We can deal with this ground very briefly. The contention is that the Claimant merely told the School that he had broken into the system. That information of itself, it is said, does not amount to a disclosure of anything tending to show that a legal obligation has been, or is likely to be, infringed.
40. In our view this submission is premised on a false assessment of what the Tribunal in fact found. The Claimant did not merely tell Mr Edmundson that he was going to break into the system; he also told him – which would have been obvious in any event - that it was because of his concerns that the system which had in fact been adopted was insecure and would too readily lead to unauthorized disclosures. (See paragraphs 21 and 22 of the Decision.) He also told Mr Edmundson and the Headmaster, after the event, what he had done. That of course involved not merely informing them that he had broken into the system but perhaps more pertinently, as far as protected disclosure is concerned, that the system had been broken into.
41. Mr Chaudhuri, for the School, accepted, as we understand it, that the latter was information tending to show that a breach of a legal obligation was likely to occur. We think that is plainly so and it does not lose that characterisation merely because it is the informer himself who broke into the system. It is true that the Claimant did not in terms identify any specific legal obligation, and no doubt he would not have been able to recite chapter and verse at the time. But it would have been obvious to all that the concern was that private information, and sensitive information about pupils, could get into the wrong hands, and it was appreciated that this could give rise to a potential legal liability.

Did the Claimant have a reasonable belief?

42. As to the second ground, Section 43B(1)(b) provides that the employee must reasonably believe that the information tends to show that the person:

"has failed or is likely to fail to comply with any legal obligation to which he is subject."

The Tribunal unhesitatingly found that the Claimant did reasonably believe that the School was likely to breach the seventh Data Protection principle. (In fact the requirement is that he must reasonably believe that the information tends to show that, but perhaps nothing turns on that distinction here).

43. The Tribunal added this:

"Indeed the claimant proved this to be the case by the tests which he conducted on the morning of 8 September 2003. It is difficult in the circumstances to see how it could not be something of breaching its obligations under the seventh Data Protection principle."

44. Mr Chaudhuri points out that Part 2 of Schedule 1 to the Data Protection Act sets out principles of interpretation of the basic principles. He refers specifically to the following provisions which is directly related to the seventh principle relied upon by the Claimant. It expressly provided in section 4 of the Act that the Data Protection principles are to be interpreted in accordance with part 2 of schedule 1 in relation to the seventh principle. In paragraph 9 of part 2 of schedule 1 it is stated as follows:

"The seventh principle   

9. Having regard to the state of technological development and the cost of implementing any measures, the measures must ensure a level of security appropriate to-
(a) the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage as are mentioned in the seventh principle, and

(b) the nature of the data to be protected."

45. Mr Chaudhuri says that the Tribunal made no reference to that. He submits that it could not properly conclude that the Claimant reasonably believed that the seventh principle would be likely to be infringed without appreciating what that principle obliged an employer to do. And that in turn meant that the Claimant had to be aware of these principles of interpretation and have had to have weighed them up when determining whether the information tended to show a likely breach or not.
46. It was an error, he said, for the Tribunal to suppose that the fact that the Claimant was able to break security was of itself sufficient to demonstrate that the security measures were inadequate and might involve a breach of the seventh principle.
47. The first point to note about this argument is that, as Mr Chaudhuri fairly says, the provision in part 2 of schedule 1 was not referred to the Employment Tribunal at all. Mr Chaudhuri says that a similar argument was advanced but not in as precise a way as he is now formulating the matter before us. But it seems to us that the following well-known authorities, such as Kumchyk v Derby County Council [1978] ICR 116, it would not be fair to permit this argument to be developed in this way for the first time before us.
48. But we will in any event say something about the substance of the matter. In this context we have considered the case of Kraus v Pinner PLC [2004] IRLR 260 which may be said to have some bearing on this argument. In that case a consultant was employed by a company to advise on redundancies. His contract was terminated because, said the employers, he did not appear to have any enthusiasm for the proposed redundancy strategy. He said that he was dismissed because he had told a director that the redundancies proposed "could breach employment legislation and make the company vulnerable to claims for unfair dismissal". He claimed that the termination of his contract involved a breach of section 47(B).
49. The Employment Tribunal found that he had not made a qualifying disclosure. He had failed to demonstrate that the company was likely to fail to comply with any legal obligation. The EAT, Cox J presiding, dismissed the consultant's appeal. It held that in order to be likely to fail to comply with a legal obligation it was necessary that it should be shown that it was more probable than not that there would be such a failure. Moreover, the Employment Appeal Tribunal held that the Claimant had failed to identify any specific legal obligation which would be likely to be breached.
50. The Tribunal said this:

"We do not read the Judgment as requiring that an Applicant must in all cases show a detailed knowledge of specific legal obligations or to demonstrate that a breach of the obligation is in fact more likely than not. A Court or Tribunal dealing with disclosures under this legislation is of course not required to determine whether an employee is right in saying that a legal obligation will probably be infringed. It is plain that the employee need only have reasonable belief that the information tends to show that although he may in fact be wrong. That is clear from the legislation and also from the Darnton case to which we made reference. It seems to us that a Court or Tribunal must focus on the information provided and ask if it tends to show such a failure. In the light of the information reasonably known and available to the informer does it in fact demonstrate that tendency?"

51. We do not think that the protection is lost merely because the employer may be able to show that, for reasons not immediately apparent to the employee, the duty will not apply or that he has some defence to it. The information will still, it seems to us, tend to show the likelihood of breach. It is potentially powerful and material evidence pointing in that direction even although there may be other factors which ultimately would demonstrate that no breach is likely to occur.
52. There may indeed be cases where a relatively detailed appreciation of the relevant legal obligation is required before an employee can establish that he reasonably believed that the information tended to show that a breach of a legal obligation was likely. But it would undermine the protection of this valuable legislation if employees were expected to anticipate and evaluate all potential defences, whether within the scope of their own knowledge or not, when deciding whether or not to make that disclosure.
53. Furthermore, in any event on the facts here we are satisfied that the Claimant did have a reasonable belief that the information tended to show a likely breach of the obligation. He did have a sufficient understanding of the factors which are identified in the interpretation principles. It was always appreciated by everyone that it would be a matter of real concern if personal information about pupils was capable of being accessed by third parties, particularly by other pupils. It was never suggested that the cost of implementing additional security measures, such as the Virtual LAN's system, should not be introduced because of expense, nor that it was technologically complex. Indeed, until the last moment this was going to be the system to be adopted. It was plainly reasonable for the Claimant to believe that this could readily be done; that it would not be inordinately costly and we have no doubt it would have been, had the School thought it necessary. The reason it was not introduced was not cost but rather the fact it was considered that the risks could be dealt with by an appropriate system of passwords.
54. In those circumstances, in our judgment, the Tribunal was fully justified in concluding that the employee reasonably believed that disclosing the fact that he had hacked into the system tended to show that a principle under the Data Protection Act would be likely to be infringed.
55. It is said, that as part of this argument that the Tribunal should have focussed on whether the Claimant reasonably believed that the security measures actually in place, that is the system of passwords, was adequate. But they did just that. They identify specifically at paragraph 18 of their Decision that when the Claimant returned to work in September, he was concerned about the implications of the proposed new arrangements for protecting confidential data. It is plain that the Claimant did not believe that the security system actually adopted was adequate; indeed he broke into the system in order to demonstrate that it was not, and the Tribunal considered that he had reasonable grounds for that belief.
56. The issue, as we have emphasized, is not whether the system was in fact appropriate and met the legal requirements, but only whether the Claimant reasonably believed that they were not, in the sense that it was at least likely that a breach of a legal obligation would arise. He felt that it was too easy for a hacker, at least if he were persistent enough, to break into the system. He sought to demonstrate that fact and he did so successfully.

Was his conduct protected disclosure?

57. The final ground raises what has been described, we think inaccurately, as a causation issue. The employee must be subjected to a detriment "on the grounds that" he has made a protected disclosure. As this Tribunal pointed out in London Borough of Harrow v Knight [2003] IRLR 140, applying certain observations of Lord Nicholls in the Nagarajan case ([1999] ICR 877; [1999] IRLR 572 & 574), this requires an examination of the mental processes which caused the employer to act as he did. In this context it is important to appreciate that the Tribunal accepted that the School had genuinely believed that he had hacked into the computer system without authority and that he had been disciplined for that reason.
58. There is, therefore, no issue here about what caused the dismissal. The Tribunal did not accept that it was reasonable for the employer to take the view that the hacking into the computer was unauthorised, but it did not doubt that the School had genuinely taken that view. It followed that the School believed that the Claimant had committed an act of misconduct. (See paragraph 75 of the Decision). Nonetheless, it held that this fell within the principle of protected disclosure, reasoning that on policy grounds it was wrong to treat the Claimant's conduct in hacking into the system as distinct from the disclosure of information itself. The Tribunal expressed the position as follows:

"64. We then turn to the issue of causation. The claimant must demonstrate that he has suffered a detriment on the grounds of a protected disclosure and, in order to succeed with his unfair dismissal case, that the protected disclosure was the reason or the main reason for his dismissal. The respondent argues that he had been dismissed not because he had disclosed matters of public interest but, rather, because he had without authority hacked into the computer system. The Tribunal reminds itself that the statutory scheme introduced b the Public Interest Disclosure Act 1998 is to encourage disclosures to be made internally , that is to say, to the whistleblower's own employer and that this is achieved by making protection readily available so long as the worker raises his or her concern with the employer. Prior to the enactment of the Public Interest Disclosure Act, a Worker who blew the whistle could expect to feel the full force of an organisation's disapproval by way of ostracism, criticism, poor appraisals, victimisation and even dismissal. The Tribunal is therefore acutely conscious of the policy behind the Public Interest Disclosure Act. Parliament, when framing the legislation, required an employer to have a reasonable belief in the matters being disclosed. This requirement was inserted in order to achieve a fair balance between the interests of the worker who suspects malpractice and those of an employer who could be damaged by unfounded allegations. It seems to us that it would emasculate the public policy behind the legislation for us to accept the respondent's submission that the claimant was the subject of disciplinary action not because he had blown the whistle on a suspected failure to comply with the legal obligation but rather because he had hacked into the respondent's computer system without authority. To allow an employer to defeat a Public Interest Disclosure Act case in this way would be to drive a coach and horses through the intention of the legislature that whistleblowers should have employment protection. Doubtless, had the claimant approached Mr Edmundson, Mr Brooker or anyone else for that matter, and simply said that he had a belief that the security system was inadequate, and had he been subject to disciplinary action and brought a similar complaint as he now does, the respondent would have sought to argue that he did not have the basis for a reasonable belief. The respondent cannot have it both ways. In order to obtain sufficient evidence to found a reasonable belief, the Claimant had to do more than simply express misgivings about what had happened over the summer of 2003. It is our view that the legislation must be construed purposively and the investigation undertaken by the employee to found his reasonable belief should not be divorced from the disclosure itself.

65. It is our judgment, therefore, that the claimant has established that the reason that disciplinary action was taken against him was because he made a protected disclosure."

59. Mr Chaudhari submits that the Tribunal erred in law here because the protected act is limited the disclosure itself and does not extend to any conduct which is designed to demonstrate that the belief is reasonable. He says that to permit conduct of this nature to be considered part of the disclosure would enable employees to go on a fishing expedition to seek to find evidence to justify suspicions and thereby establish a reasonable belief.
60. Mr Glazier, for the Claimant, submits that the decision of the Tribunal is justified precisely for the policy reasons that it enunciates in the paragraphs we have set out.
61. On this point we prefer the arguments of the School. We consider that the Tribunal did fall into error in this part of its decision. The statute protects disclosure but not other conduct by the employee even if connected in some way to that disclosure (c.f. the wider scope of the victimisation provisions under the Race Relations Act as reflected in the decision in Aziz v Trinity Street Taxis Ltd [1988] IRLR 204).
62. In this case the employee had not been subject to any discipline proceedings when he had earlier forcibly expressed views about the security system that should be adopted, nor is there any reason to suppose that he would have been disciplined if he had simply informed the school that someone else had hacked into the system. The employers acted because of their belief that it was irresponsible for him to have done so even if the purpose was to demonstrate the force of his concerns.
63. We note incidentally that in reaching this conclusion, we are expressing views consistent with some observations of this Tribunal in the case of Aspinell v Mech Forge Ltd EAT/891/01 in which this Tribunal, HHJ Reid QC presiding, noted that it had reservations about a concession in that case that the making of a video was a protected disclosure because it was linked to the subsequent disclosure of the information to the employer.
64. The Tribunal sought to justify its conclusion on policy grounds. It observed that if the Claimant had simply noted that the security system was inadequate and had been disciplined then the employers would have said that he had no reasonable grounds for his belief. The point is, however, it seems to us, that if he had done simply that there is no reason to suppose that he would have been subject to any disciplinary sanction at all. And even if he had, the law only protects him if he has reasonable grounds for his belief. It does not allow him to commit what would otherwise be acts of misconduct in the hope that he may be able to establish the justification for his belief.
65. An employee cannot be entitled to break into his employer's filing cabinet in the hope of finding papers which will demonstrate some relevant wrongdoing which he can then disclose to the appropriate person. He is liable to be disciplined for such conduct, and that is so whether he turns up such papers or not. Provided that his misconduct is genuinely the reason for the disciplinary action, the employee will not be protected even if he does in fact discover incriminating papers. Success does not retrospectively provide a cloak of immunity for his actions, although he will then of course be protected with respect to the subsequent disclosure of the information itself.
66. We have considered the point, which we recognise can be put forcefully in this case, that the Tribunal found that the Claimant did indeed have authority for testing the system. But we have come to the view that this still does not bring his testing within the protected category for two reasons in particular.
67. First, this was not the understanding of the employers when they dismissed him. The Tribunal found that the School was wrong to consider that he had not been authorised, and that is of course highly relevant indeed to the question of whether he had been unfairly dismissed in the ordinary way, but it does not affect the reason why he was dismissed. Second, and in any event, it seems to us that the fact of authority would not of itself convert into a protected disclosure something that otherwise was not a disclosure.
68. We think there are two quite separate issues here. First, the conduct designed to demonstrate that the belief was reasonable and, second, the disclosure of the information itself which tended to show a breach of the relevant legal obligation. Putting it simply, it seems to us that the law protects the disclosure of information which the employee reasonably believes tends to demonstrate the kind of wrongdoing, or anticipated wrongdoing, which is covered by section 43B. It does not protect the actions of the employee which are directed to establishing or confirming the reasonableness of that belief. The protection is for the whistleblower who reasonably believes, to put it colloquially if inaccurately, that something is wrong, not the investigator who seeks either to establish that it is wrong or to show that his concerns are reasonable.
69. The question is what follows from this finding. Plainly the finding that there was the imposition of a detriment falling within section 47B and the conclusion that there is an automatically unfair dismissal contrary to section 103A cannot stand. However, the Tribunal found that the dismissal was in any event unfair under section 98 both because of procedural failings and because it was a breach of trust and confidence for the employer to have disciplined the employee in the circumstances, given that contrary to the School's understanding, he was in fact authorised to act as he did.
70. Mr Chaudhari submits that if 47B falls, as we have found that it does, then it is not possible to sustain the finding of constructive dismissal for the reason given by the Tribunal. This is what the Tribunal said about the matter at paragraph 72:

"72. In circumstances where an employer reacts in a hostile, provocative or insensitive manner towards an employee who makes a disclosure, then it is easy to see how this can lead to claims that the employer has breached the fundamental implied term of trust and confidence. The Tribunal has found that the claimant was subject to a detriment on the grounds that he made a protected disclosure. It follows, therefore, that the disciplinary action which the respondent chose to invoke against the claimant was unwarranted. The Tribunal therefore finds that the respondent's actions did amount to a fundamental breach of contract in that its actions destroyed without proper cause mutual trust and confidence."

71. Mr Chaudhuri says that the Tribunal's reasoning cannot now be sustained if there is no breach of section 47B. We think that is right. That is not to say that the Tribunal could not properly reach the conclusion that there was a constructive dismissal. It could have come to that conclusion, it seems to us, by considering all the circumstances of the case, but it has established the constructive dismissal by focusing specifically on the fact that there was a protected disclosure. We do not think it is possible to say with complete confidence that a Tribunal would necessarily have reached the same result had it not focused on the protected disclosure and it seems to us, therefore, that the appropriate step to take now is to remit the matter for findings on that particular issue only.
72. Mr Chaudhari suggested it should go to a different Tribunal. We think there is no reason here why it should not go back to the same Tribunal that has considered this case and did so over many days. We send it back, purely on the single issue of whether there was a constructive dismissal. If there was, then the Tribunal's findings on unfair dismissal will stand; if not then of course there is no dismissal and there can be no unfair dismissal.
73. It will be for the Tribunal to decide whether it wishes to hear further evidence on that point. It is not obvious to us that there will be any relevant further evidence but we would not foreclose that possibility and it will no doubt wish to hear the submissions of the parties in any event.
74. We have to say that we reached the conclusion that this case should go back with some reluctance because the events giving rise to this matter occurred now almost two and a half years ago. It may be that the parties will be seek to come to some compromise so that the time and costs of a further hearing can be avoided.
75. It follows that the appeal succeeds. The finding of automatic unfair dismissal cannot stand, nor can the conclusion that Claimant suffered a detriment by reason of making a protected disclosure contrary to section 47B of the 1996 Act.
76. We remit the case on the limited basis which we have indicated, that is, to determine whether or not there was in the circumstances a constructive dismissal.