Data breach dismissal: employee awarded only two weeks' pay after 100% contributory conduct finding
An accounts employee who emailed 298 tenant contact details to an unsecured address was unfairly dismissed because no disciplinary procedure was followed, but a 100% contributory fault finding reduced his compensation to just £1,361.54.
2 min read · Last updated 18 May 2026
Key facts
- The claimant was employed from 1 March 2015 to 29 October 2021 as an accounts employee.
- The claimant emailed 298 tenant contact details to an unsecured email on 25 October 2021.
- The respondent dismissed the claimant for conduct (data breach) without following any disciplinary procedure.
- The claimant alleged he was dismissed for making protected disclosures about embezzlement, but the tribunal found no reasonable belief.
- The tribunal held that a fair procedure would have taken two weeks and dismissal would have been inevitable.
- The claimant was awarded two weeks' net pay (£1,361.54) as compensatory award, with no basic award due to 100% contributory conduct.
Timeline
-
Employment started
Claimant began employment with Defries Associates Ltd.
-
Settlement agreement overheard
Claimant overheard discussions about a confidential settlement with a former employee.
-
Tap invoice created
Simon Shoker instructed a tap installation, with £45 billed to respondent and £129 to a client account in error.
-
Claimant alleges discovery of tap invoice
Claimant says he found the tap invoice and reported it to Mr Rubens as embezzlement; respondent disputes this.
-
Claimant resigned
Claimant emailed resignation, giving three months' notice, but continued working.
-
Claimant raised tap invoice again
Claimant alleged the tap invoice was proof of embezzlement; respondent treated it as an error.
-
Data breach email sent
Claimant emailed directors alleging embezzlement and included contact details of 298 tenants.
-
Dismissal
Respondent dismissed claimant for conduct (data breach and breach of trust).
-
Appeal letter
Claimant appealed, raising the settlement agreement as a further alleged disclosure.
-
Holiday pay paid
Respondent paid claimant £1,926.47 for accrued holiday pay.
The legal issue
The tribunal had to decide whether the employee was unfairly dismissed for sending a mass email containing tenant data, whether he had made protected disclosures about alleged embezzlement, and what remedy was appropriate.
The outcome
The tribunal held that the employee was unfairly dismissed because the employer failed to follow any disciplinary process before dismissing him for the data breach.
However, the tribunal also found that:
- The employee did not make any protected disclosures – his allegations about a 'tap invoice' were not made in the reasonable belief that it showed criminal activity.
- A fair procedure would have taken just two weeks, and dismissal would have been the inevitable outcome given the serious data breach.
- The employee's conduct was 100% contributory to his dismissal.
Compensation:
- Basic award: £0.00 (reduced to nil due to 100% contributory conduct)
- Compensatory award: £1,361.54 (two weeks' net pay, reflecting the time a fair procedure would have taken)
Lessons & takeaways
- Even if an employee has committed a serious act like a data breach, a fair disciplinary process must still be followed – skipping it entirely will make the dismissal unfair.
- Alleging wrongdoing by colleagues does not automatically amount to a protected disclosure; the employee must have a reasonable belief that the information tends to show a relevant failure.
- A 100% contributory conduct finding can reduce compensation to almost nothing, even when the dismissal is technically unfair.
- Employers should act promptly when a data breach occurs, but must still give the employee a chance to respond before deciding to dismiss.
A serious data breach, but no procedure at all
This case shows what happens when an employer reacts to a serious data breach by dismissing the employee on the spot without any investigation or hearing. The employee, an accounts worker with six years' service, emailed a spreadsheet containing the personal details of 298 tenants to an unsecured email address. The employer, Defries Associates Ltd, dismissed him for gross misconduct the same day.
While the data breach was clearly serious, the tribunal found that the employer's failure to follow any disciplinary process made the dismissal procedurally unfair. Even a short, basic procedure – giving the employee a chance to explain, investigating the facts, and considering alternatives – would have satisfied the legal requirement.
What the employer could have done differently
The employer's main mistake was acting too quickly. A fair process would have taken about two weeks, the tribunal said. During that time, the employer could have suspended the employee, gathered evidence, held a meeting, and made a considered decision. Instead, by dismissing immediately, the employer lost the ability to argue that the dismissal was within the 'range of reasonable responses' – the key test for fairness in conduct cases.
However, the tribunal also found that the employee's own conduct was entirely to blame for his dismissal. He had sent the data without authorisation, and his allegations about a colleague's 'embezzlement' were not made in good faith or with reasonable belief. As a result, his compensation was reduced by 100% for contributory fault, leaving him with only two weeks' net pay – the period a fair procedure would have taken.
Why this matters for similar claims
This case is a reminder that procedural fairness matters, even when the employee's conduct is clearly wrong. Employers who skip the process risk an unfair dismissal finding, but the compensation may still be minimal if the employee's own actions caused the dismissal. For employees, it shows that alleging wrongdoing by others does not automatically give whistleblowing protection – the belief must be objectively reasonable. And for both sides, the case highlights that a 100% contributory conduct finding can effectively wipe out compensation, even where the dismissal is technically unfair.
Similar cases
Area manager dismissed for editing timesheet: procedural failures led to unfair dismissal finding
An area manager was unfairly dismissed after editing a timesheet, but the tribunal found the investigation was flawed and the disciplinary process lacked proper notice. He was awarded £8,026 after reductions for contributory conduct and a Polkey finding.
Ward manager unfairly dismissed after employer mistook cannabis metabolite for cannabis
A 40-year nursing veteran was unfairly dismissed by Priory Healthcare after the employer mistakenly believed a urine test showed she was under the influence of cannabis at work. The tribunal found the dismissal was outside the range of reasonable responses.
Customer assistant dismissed for misusing discount code: partial win after 9 years' service
A Lidl customer assistant was unfairly dismissed for gross misconduct over a chicken discount code and a dwarf plant purchase, but the tribunal awarded only £633.60 after finding she was 90% to blame.
Consultant gynaecologists dismissed for victimisation: unfair process but no compensation
Two long-serving consultant gynaecologists were unfairly dismissed by Brighton and Sussex University Hospitals NHS Trust, but the tribunal awarded no compensation because they would have been dismissed anyway and were wholly at fault.