Disciplinary for data breach

IT expert Tasmin will tell you she knew the importance of cyber security better than anyone, so to be dismissed for failing to protect confidential information was devastating.

She was sacked after six years working in the education sector following a data breach said to have occurred because she failed to act on advice to update security settings.

At a disciplinary hearing it was alleged that Tasmin’s negligence led to confidential information being exposed to hackers.

Tasmin insisted she was not to blame and that she was unfairly being made a scapegoat.

She was adamant it was never made clear the update was critical, which is what was alleged.

Tasmin exercised her right to be accompanied at the disciplinary hearing by an experienced male colleague, and he helped her to present a comprehensive argument that it was not her fault.

After being dismissed Tasmin was advised by her colleague it was an unfair dismissal and she should challenge the outcome. He urged her to get expert help to do so.

This led Tasmin to contact our Employee Support Centre for support to appeal against the decision.

Tasmin provided our representative with a wealth of information related to the case, which included her comprehensive response to the allegation that led to her dismissal.

The case paperwork showed that Tasmin did raise a grievance during the disciplinary process because she felt it was unfair. The grievance was rejected and a subsequent appeal was unsuccessful.

Our representative, after thoroughly reviewing the case believed the employer had been dismissive in its response to the evidence presented by Tasmin.

This was based on the one-page disciplinary outcome letter which effectively said Tasmin’s case was listened to, her actions amounted to gross misconduct and dismissal was the outcome.

Our representative submitted a disciplinary appeal on behalf of Tasmin.

In the appeal letter he requested all of the evidence from any investigations the employer carried out after the hearing the case, and in response to any points raised by Tasmin in her rebuttal of the allegation.

The employer confirmed it did not carry out any further investigations.

Prior to an appeal hearing, our representative will always discuss an employee’s desired outcome in order so that they know what they are working towards.

Tasmin wanted to be reinstated because she loved her job and after making a flexible working request that was accepted, the role gave her a perfect work-life balance, and was ideal for her.

The decision to dismiss Tasmin was because she was considered to be responsible for not implementing critical security updates, despite being told to do so by her manager.

At the disciplinary appeal hearing our representative in arguing the decision to dismiss was unfair, highlighted the lack of investigation in response to evidence presented by Tasmin.

She had provided evidence, including email exchanges that showed she had not received direct instructions to prioritise the security update.

Our representative was also able to refer to evidence that demonstrated that the update had not been flagged as critical, as claimed.

In addition to this our representative emphasised Tasmin’s previous and exemplary work record of dealing with similar situations successfully.

There was also evidence provided by Tasmin that was used to point out that the employer’s training on new procedures had been inadequate and that the manager’s communication was not expressly clear.

Our representative told the hearing Tasmin had always been a dedicated employee, known for her attention to detail and commitment to the organisation’s values.

He acknowledged that there may have been a genuine lapse, but argued that it was due to the lack of clear communication from the manager regarding the urgency of any updates.

Tasmin was asked a number of questions that she dealt with, along with support from our representative emphasising key points.

The appeal proved successful and Tamsin later got her wish to be reinstated.

It is also worth noting, that as the case centred on a data breach there was an official external investigation. It did find that the breach was not as a result of any negligence by an individual.