Bolton School v Evans

LORD JUSTICE BUXTON: The appellant, Mr Evans, was employed by the respondent, a well-known independent school, as a teacher in its Information and Communication Technology (“ICT”) department. After a disciplinary procedure he was given a warning as to his conduct. He objected to that warning, to the extent that he resigned from his employment. The Employment Tribunal (“ET”) found that the warning was given because Mr Evans had made a protected disclosure under section 43A of the Employment Rights Act 1996, the colloquially called whistle-blowing provisions. That meant that he was to be regarded as constructively unfairly dismissed by the operation of section 103A of that Act. The issue in this appeal is whether the ET was justified as a matter of law in finding that that was the only, or the principal, reason for Mr Evans’s dismissal.

The facts are addressed in considerable detail in the judgment of the Employment Appeal Tribunal (“EAT”). I set out here only what is necessary to understand the issues in this appeal.

Between May 2002 and June 2003 the school’s ICT project group (a service and not a teaching unit) had in hand the installation of a new computer system. Mr Evans was not a formal member of that group, but he took a close interest in its work, and it was accepted that he was motivated to try to ensure that a proper system was adopted. His main concern was security issues, particularly important because it was proposed the same network should be used both by pupils and also for administrative purposes by the staff, including in the latter respect the keeping of the pupils’ records. Put very shortly, while the system was being installed during the summer holidays of 2003 the head of the project group decided that the security system originally agreed was not required, and that password security would be adequate; and that alone was what was provided. I have taken account of what followed directly from paragraphs 13 to 18 of the judgment of the Employment Appeal Tribunal which I set out at this point in the judgment:

“The Claimant was informed about this when he returned to school on 1 September 2003. He was concerned that the security protection was inadequate. He wished to demonstrate the inadequacy of the system. Accordingly, on 5 September, he went to the learning centre and used a PC to which students will have access and adopted a technique which enabled him to gain access to the encrypted passwords for the PC and then save them to a floppy disc which he could take away. He said that this task took him no more than 10 minutes.

“Later on that day, 5 September, he told Mr Edmundson that he was attempting to gain access to the system in order to test security and to demonstrate what he perceived to be its failings. Mr Edmundson was the member of staff who had been designated by the headmaster, Mr Brooker, to be the individual who should be contacted if there were concerns about the IT network. The Claimant also discussed potential security weaknesses with -Mr Humphreys, who was head of computing in the school. The Claimant told Mr Humphreys that he thought he would be able to gain access to information which ought to be limited only to staff members. Mr Humphreys told him to consult with Mr Edmundson. The Claimant said that he had already done that. Mr Humphreys was content for the Claimant to undertake a simple test to see if he could gain administrative access from resources available to pupils.

“The Tribunal also found that there were somewhat ambiguous instructions as to whether or not staff could test the system. Apparently, it had happened on occasions in the past. Armed with a floppy disc which he had acquired on 5 September, the Claimant set about decoding the passwords over the weekend of 6 and 7 September. He admitted to having engaged the assistance of a former pupil at the school when carrying out that task.

“He returned to the school on the Monday morning and gained access to the system from a student PC in the technology department and disabled some of the user accounts for the ICT services department, which was a non-teaching department within the school. He did not affect any data on the system and teachers and staff were still able to have access to the computer. He then informed Mr Edmundson of what he had done and told other staff members, including Mr Humphreys and other ICT staff.

“He knew that ICT services would not be able to gain access to the system but he did not mention it to them. The Tribunal found that there was indeed considerable friction between the Claimant and Mr Fox, who was the head of ICT services. At 10.25am that morning the Claimant told the headmaster, Mr Brooker, what he had done. But the headmaster appeared somewhat distracted, no doubt understandably on the first week of a new academic year, and advised the Claimant to see Mr Edmundson.

“He was then requested by Mr Humphreys to demonstrate how he had accessed the system. At this stage, ICT services shut down the entire network. They suspected, correctly of course, that someone had hacked into the system. The Claimant considered this to be a panic reaction for ICT services were unwilling to take risks. The school says that the financial losses caused by the claimant's actions are in the region of £1,000. The ICT services team spent, apparently, some hours that day reinstating the system.

A disciplinary interview was then held by Mr Booker, the headmaster. He is recorded as having said at the outset (a matter that is said to indicate that he did not approach the interview with an open mind) that Mr Evans “had deliberately hacked into the network, that it was premeditated and that the claimant had no authorisation to do this and that the claimant had spent the weekend attempting to decode passwords.” That is taken from paragraph 34 of the determination of the ET. It was on that basis that Mr Evans was given his written warning.

Something should be briefly said here of the use of the term “hacking”. Counsel for the appellant said that it was inappropriate, because it had been accepted that Mr Evans had authority to enter the system and amongst other things had committed no offence under the Computer Misuse Act 1990, which is regarded as addressing hacking. In fact the Act does not employ the latter term, which remains a colloquialism. That colloquialism was no doubt used here to indicate the headmaster’s view or belief that the specific use that Mr Evans had made of the computer had been improper, without descending into the Act’s provisions on authorisation, which the respondents have decided not to explore.

Mr Evans contended that he had been warned because, and accordingly had been constructively dismissed because, he had made a potential disclosure as defined in section 43B of the 1996 Act:

“43B Disclosures qualifying for protection

“(1)

In this Part a ‘qualifying disclosure’ means any disclosure of information which, in the reasonable belief of the worker making the disclosure, tends to show one or more of the following

“(a)

that a criminal offence has been committed is being committed or is likely to be committed,

“(b)

that a person has failed, is failing or is likely to fail to comply with any legal obligation to which he is subject,

“(c)

that a miscarriage of justice has occurred is occurring or is likely to occur,

“(d)

that the health or safety of any individual has been, is being or is likely to be endangered,

“(Mr Evans) that the environment has been, is being or is likely to be damaged, or

“(f)

that information tending to show any matter falling within anyone of the preceding paragraphs has been, or is likely to be deliberately concealed ...

“(3)

A disclosure of information is not a qualifying disclosure if the person making the disclosure commits an offence by making it ..

In more detail, Mr Evans relied on section 43B(1)(b), in that he was being disciplined for drawing the school’s attention for breaches of the Data Protection Act 1998. Specifically, he was concerned about the breach of the seventh Data Protection principle set out in part 1 of schedule 1 to that Act which is as follows:

“Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to personal data.”

The school said that Mr Evans was not disciplined for drawing attention to that, but because of his conduct of breaking into the computer, including his involvement of a former pupil in that entry.

The ET found, at paragraph 63, that Mr Evans had made a public interest disclosure. It then turned to what it described as the issue of causation. The Employment Tribunal appears to have accepted that the school’s motivation for dismissing Mr Evans was indeed his conduct in entering the system in the way that he did, but it held that that was part and parcel of his protected disclosure. The ET reasoned as follows in paragraph 64 of its determination, which I shall set out at one point substituting for the word “employer” the word “employee”, which was clearly intended. The ET said this:

“We then turned to the issue of causation. The claimant must demonstrate that he has suffered a detriment on the grounds of a protective disclosure and, in order to succeed with his unfair dismissal case, that the protected disclosure was the reason or the main reason for his dismissal. The respondent argues that he has been dismissed not because he had disclosed matters of public interest but, rather, because he had without authority hacked into the computer system. The Tribunal reminds itself that the statutory scheme introduced by the Public Interest Disclosure Act 1998 is to encourage disclosures to be made internally, and that is to say to the whistleblower’s own employer and that this is achieved by making protection readily available so long as the worker raises his or her concern with the employer. Prior to the enactment of the Public Interest Disclosure Act, a worker who blew the whistle could expect to feel the full force in an organisation’s disapproval by way of ostracism, criticism, poor appraisals, victimisation and even dismissal. The Tribunal is therefore acutely conscious of the policy behind the Public Interest Disclosure Act. Parliament, when framing the legislation, required an [employee] to have a reasonable belief in the matters being disclosed. This requirement was inserted in order to achieve a fair balance between the interests of the worker who suspects malpractice and those of an employer who could be damaged by unfounded allegations. It seems to us that it would emasculate the public policy behind the legislation for us to accept the respondent’s submission that the claimant was the subject of disciplinary action not because he had blown the whistle on a suspected failure to comply with the legal obligation but rather because he had hacked into the respondents’ computer system without authority. To allow an employer to defeat a Public Interest Disclosure Act case in this way would be to drive a coach and horses through the intention of the legislature that the whistleblower should have employment protection. Doubtless, had the claimant approached Mr Edmondson, Mr Brooker or anyone else for that matter, and simply said that he had a belief that the security system was inadequate, and had he been subject to disciplinary action and brought a similar complaint as he now does, the respondent would have sought to argue that he did not have the basis for a reasonable belief. The respondent cannot have it both ways. In order to obtain sufficient evidence to found a reasonable belief the claimant had to do more than simply express misgivings about what had happened over the summer of 2003. It is our view that the legislation must be construed purposefully and an investigation undertaken by the employee to found his reasonable belief should not be divorced from the disclosure itself.”

The school appealed against that conclusion on three grounds. The first two were that Mr Evans had made no protective disclosure at all; and that he did not have a reasonable belief that the school was in breach of the relevant data protection principle. The EAT rejected both of those arguments, and they are not sought to be maintained before us. Put very shortly, the EAT accepted that Mr Evans had not only told Mr Edmondson that he was intending to access the system, but had also told him that the reasons for doing that was his concern about its security; and secondly that Mr Evans did reasonably think that other and more secure ways of protecting data in the system were available, and thus of conforming to the data protection principle on which Mr Evans relied: not least the system that Mr Evans had understood was going to be installed until he discovered the change of policy on his return from holiday: see the account given above.

On the third and crucial issue, the EAT did not agree with the ET’s categorisation of the question in terms of causation. The EAT said in paragraphs 57 and 58:

“The employee must be subject to a detriment “on the grounds that” he has made a protected disclosure. As this Tribunal pointed out in London Borough of Harrow against Knight [2003] IRLR 140, applying certain observations of Lord Nicholls in the Nagarajan case [1999] ICR 877, this requires an examination of the mental processes which cause the employer to act as he did. In this context it is important to appreciate that the tribunal accepted that the School had genuinely believed that he had hacked into the computer system without authority and that he had been disciplined for that reason. [58] There is, therefore, no issue here about what caused the dismissal. The Tribunal did not accept that it was reasonable for the employer to take the view that the hacking into the computer was unauthorised, but it did not doubt that the School had genuinely taken that view. It followed that the School believed that the Claimant had committed an act of misconduct. (See paragraph 75 of the [ET’s] Decision).”

The EAT accordingly concluded that Mr Evans had been dismissed not because he made the disclosure but because of his conduct in entering the computer. It however expressed itself at somewhat greater length in paragraphs 64 to 68, which it would be convenient to set out:

“64.

The Tribunal sought to justify its conclusion on policy grounds. It observed that if the Claimant had simply noted that the security system was inadequate and had been disciplined then the employers would have said that he had no reasonable grounds for his belief. The point is, however, it seems, to us, that if he had done simply that there is no reason to suppose that he would have been subject to any disciplinary sanction at all. And even if he had, the law only protects him if he has reasonable grounds for his belief. It does not allow him to commit what would otherwise be acts of misconduct in the hope that he may be able to establish the justification for his belief.

“65.

An employee cannot be entitled to break into his employer's filing cabinet in the hope of finding papers which will demonstrate some relevant wrongdoing which he can then disclose to the appropriate person. He is liable to be disciplined for such conduct, and that is so whether he turns up such papers or not. Provided that his misconduct is genuinely the reason for the disciplinary action, the employee will not be protected even if he does in fact discover incriminating papers. Success does not retrospectively provide a cloak of immunity for his actions, although he will then of course be protected with respect to the subsequent disclosure of the information itself.

“66.

We have considered the point, which we recognise can be put forcefully in this case, that the Tribunal found that the Claimant did indeed have authority for testing the system. But we have come to the view that this still does not bring his testing within the protected category for two reasons in particular.

“67.

First, this was not the understanding of the employers when they dismissed him. The Tribunal found that the School was wrong to consider that he had not been authorised, and that is of course highly relevant indeed to the question of whether he had been unfairly dismissed in the ordinary way, but it does not affect the reason why he was dismissed. Second, and in any event, it seems to us that the fact of authority would not of itself convert into a protected disclosure something that otherwise was not a disclosure.

“68.

We think there are two quite separate issues here. First, the conduct designed to demonstrate that the belief was reasonable and, second, the disclosure of the information itself which tended to show a breach of the relevant legal obligation. Putting it simply, it seems to us that the law protects the disclosure of information which the employee reasonably believes tends to demonstrate the kind of wrongdoing, or anticipated wrongdoing, which is covered by section 43B. It does not protect the actions of the employee which are directed to establishing or confirming the reasonableness of that belief. The protection is for the whistleblower who reasonably believes, to put it colloquially if inaccurately, that something is wrong, not the investigator who seeks either to establish that it is wrong or to show that his concerns are reasonable.”

The EAT’s decision, rejecting the policy arguments of the ET and applying the wording of the statute, would seem to be a short issue of construction, but it has attracted some elaborate arguments in this court.

The first Ground of Appeal, drawn by Mr Evans when he was representing himself, said:

“The [EAT] erred in law … by finding that the Appellant’s Disclosure of the Information that he had breached the Respondent’s computer system security was a qualifying Disclosure of Information as defined by section 43B of the Employment Rights Act 1996 but that the disciplinary action was not taken as a result of that Disclosure but as a result of the actual action in breaching the system security. Whilst failing to consider that the only evidence presented to the Appellant as justification for that disciplinary action by the Respondent was that Disclosure of Fact.”

Mr Barnett, who appeared for Mr Evans in this court, did not apply to amend that Ground, but said that it should be understood in the following terms that he set out in paragraph 51 of his skeleton:

“The reference to ‘any disclosure of information’ within the definition of a ‘qualifying disclosure’ is wide. It covers disclosure by conduct. It covers disclosure of an individual’s own wrongdoing (subject to subsequent exclusions of conduct amounting to an offence, and disclosures which are not made in good faith). It covers any actions or words within a series of actions or utterances which, cumulatively, amount to a ‘disclosure of information’.”

I do not find it easy to extract that from the wording of the Ground, but no doubt some latitude should be exercised in view of Mr Evans’s lack of representation when he drew that Ground. The nub of the argument as presented in this court, and more particularly as presented in the oral submissions that we have received this morning, is that the whole course of conduct of Mr Evans should be regarded as an act of disclosure, so the hacking was part of the disclosure, and if Mr Evans was warned because of the hacking, as the school said that he had been, that was in itself an admission that he had been dismissed for making a protective disclosure. Mr Barnett called this an “entire transaction” approach to disclosure. The argument was supported both by arguments of policy and construction, and by analysis of the facts to bring them within the entire transaction approach.

As to construction, Mr Barnett as I understood him supported the policy-based approach of the ET, but added to it further arguments based on the terms of the legislation. He reminded us of the long time and Public Interest and Disclosure Act 1998, the source of the present provisions, which says that they are “to protect individuals who make certain disclosures of information in the public interest”; and he pointed to the use in section 43B(1) of the word “any” disclosure. These factors were said to point to the need to give a wide meaning of the concept of qualifying disclosure, in the interests of the employee.

I am afraid that I was not persuaded by any of that. The legislation uses a common word, “disclosure”, and sets out in some detail the circumstances in which that disclosure will or will not be protected. There is no reason to think that Parliament intended to add to that machinery by introducing some special meaning of the word disclosure. Indeed the ET itself, in some detail in the passage that we just looked at pointed to the controlling structures imposed by the act. The question of whether the conduct for which the employee was disciplined was indeed “disclosure” accordingly remains a question for the normal meaning of that word. Nor did the ET think otherwise. It did not reach its conclusion by construing the word disclosure, but rather introduced a straightforward policy determination that the Act should extend not only to the disclosure itself but also to the conduct of the employee leading up to that disclosure.

Accordingly, was the whole of the conduct of the employee an act of disclosure? The factual contentions supporting the argument that it was were that the EAT had overlooked (as indeed the ET itself must have) that (i) Mr Evans had not only told Mr Edmundson that he was going to enter the system, but had also announced to the headmaster his successful demonstration that the system was insecure. Without that announcement the employer could not have known that it was Mr Evans who had entered the system, because he had been using not his own access codes but codes belonging to other people that he had abstracted from the system. If he was disciplined for that act of access, as the school said he was, it must follow that he was disciplined for informing the school that he had access to them in the first place. (ii) “disclosure” can be by acts as well as by words. Mr Evans’s conduct in entering the system should have been regarded as an act of disclosure in itself, and since the school gave him the warning for that act by the same token it gave him the warning for a relevant disclosure. On mature reflection in the course of argument Mr Barnett, as I understood it, withdrew the latter contention. If that is the position it seriously undermines the rest of the argument, because the non-verbal elements that the “entire disclosure transaction” is said to contain are thus not themselves disclosure at all.

Addressing the argument more generally, none of it is discernible from the submissions in the tribunals below, where Mr Evans did not have the benefit of professional representation but was nonetheless represented by employment consultants. Nor, it seems to me, does it clearly raise any issue of law, which is the limit of the jurisdiction of the EAT and of this court, since a complaint at this stage has to be, not that the EAT misconstrued the statute, but that it wrongly analysed the facts to which it applied that statute. I will however put that reserve on one side, and consider the case on its merits.

The construction sought to be placed on Mr Evans’s activity is highly artificial, which may be why no-one has previously suggested it. First, when Mr Evans told the headmaster that he had entered the system he was doing two things. He was reporting what he had already told Mr Edmundson about the vulnerability of the system; and he was reporting his own actions. When he was disciplined for those actions he was indeed disciplined for those actions, and not for telling the headmaster about them. Second, when performing the physical act of entering the system he was not then communicating with the school about the vulnerability of the system. That was why Mr Evans himself thought that that communication had to take place in verbal terms by speaking to the headmaster. That is why, as already noted, I understand the point now to have been withdrawn.

But even assuming, contrary to what he has said in paragraph 17, that Mr Evans’s whole course of conduct should be regarded as a continuing act of disclosure, the employer’s reason for the warning, as found by the ET, was its belief that Mr Evans had at the same time committed an act of misconduct. That was, in the terms of section 103A, the reason (or, if more than one, the principal reason) for what turned into a constructive dismissal. While I agree that the tribunal should look with care at arguments that say that the dismissal was because of acts related to the disclosure rather than because of the disclosure itself, in this case there is no reason to attribute ulterior motives to the employer. Although not seized of this point, the EAT made observations that are very pertinent to it in paragraph 64 of its determination:

“In this case the employee had not been subject to any discipline proceedings when he had earlier forcibly expressed views about the security system that should be adopted, nor is there any reason to suppose that he would have disciplined if he had simply informed the school that someone else had hacked into the system. The employers acted because of their belief that it was irresponsible for him to have done so even if the purpose was to demonstrate the force of his concerns.”

We were urged to look at the whole of Mr Evans’s activities, and not just at his verbal encounters with Mr Edmundson and Mr Booker. If that is done, it becomes plain, as both tribunals below found, that the warning was given for Mr Evans’s irresponsible conduct, and not for telling his employers, by whatever means, that their system was insecure.

Both sides adduced their hypothetical cases said to support their contentions. I do not address these. They were not illuminating, not least because most or all of them fell to be resolved by parts of the legislation with which we are not concerned. Nor do I address the various criticisms of the hypothetical adopted by the EAT itself. Contrary to Mr Barnett’s submissions, that was not the centre-point or basis of their decision, which stands whether or not the hypothetical was apt.

I should also note that under this Ground some reference was made to the guidance given in the case of Igen v Wong, referred to in more detail in respect of ground two of the appeal. Even on the assumption that the tribunal had to be satisfied that the dismissal was on no grounds whatsoever because of the protected disclosure, that requirement was satisfied by the finding that the dismissal was indeed on the ground of the hacking, and not on the ground of the disclosure.

Igen v Wong also featured in the second Ground of Appeal, which complained that it had not been open to the EAT to proceed on the basis that the school had genuinely believed that Mr Evans had no authority to enter the system in the way that he did, when on the findings of the ET that had not been a reasonably held belief and had not been reached after an investigation. It was argued that there should be applied by analogy the well-known guidance of Peter Gibson LJ in Igen v Wong [2005] ICR 931 [14(10)], that the burden rests on the employer to prove that a prima facie discriminatory act was “in no sense whatsoever” on the grounds of [protected disclosure]. Here again, however, the EAT provided the answer to a question that was not put to it. In paragraph 67, already set out above, the EAT said:

“The Tribunal found that the School was wrong to consider that he had not been authorised, and that is of course highly relevant to the question of whether he had been unfairly dismissed in the ordinary way, but it does not affect the reason why he was dismissed.”

I respectfully agree. The protected disclosure to the headmaster was also the means whereby the headmaster found out about the misconduct; but the question under the Act is not how the employer found out about the misconduct, but why he disciplined the employee. The ET’s findings as to why Mr Evans was disciplined is a conclusive answer to the question of whether in any sense whatsoever he was dismissed for making a protected disclosure.

The ET’s reasoning, based as it was on a so-called “purposive” interpretation that paid no respect to the wording of the statute, was only lightly pursued in this court. The attempt to rehabilitate the ET’s decision on grounds never put to it equally failed. I would dismiss the appeal.

Having found that the ET’s reason could not be sustained in the light of the conclusion that there had been no breach of section 47B the EAT continued, at paragraph 71:

“That is not to say that the Tribunal could not properly reach the conclusion that there was a constructive dismissal. It could have come to that conclusion, it seems to us, by considering all the circumstances of the case, but it has established the constructive dismissal by focussing specifically on the fact that there was a protected disclosure. We do not think it possible to say with complete confidence that a Tribunal would necessarily have reached the same result had it not focussed on the protective disclosure and it seems to us, therefore, that the appropriate step to take now is to admit the matter for findings on that particular issue only.”

That step is not in itself appealed, but the school seeks to complain of the EAT’s decision, after submissions, to remit the matter to the same tribunal. The basis of this complaint was that the ET had effectively made up its mind on that question, and the EAT had given no reasons why it did not, as it should have done, find that fact conclusive against remission to that tribunal.

I can well understand why the school might prefer a different tribunal, but this is an issue of judgement, on which I would be reluctant to differ from the judgement of the court below, which must have had the matters complained of in mind. I am particularly reluctant to differ from a tribunal presided over by the President of the EAT, which has a much better understanding and experience than this court on the realities of employment tribunal proceedings. I would also dismiss the cross-appeal.

LORD JUSTICE LATHAM: I agree.

LORD JUSTICE LONGMORE: I agree also.