0

I work for a small UK company in the IT department.

Hearing other employees struggle with the slow internet connection I discover malicious software (trojan horse) in the Internet access point.

I had concerns that in the installation of Trojan Horse may be involved someone from technical management. Therefore I addressed the issue directly to the company owner also suggesting a non-invasive and silent audit of the internal network. I got permission from Company owner to conduct an examination.

Two months later I have been accused of a possible gross of misconduct addressed as Data Breach according to the ISO 27001 standard.

My concern is that the disciplinary investigation and hearing process which implied in The letter of termination (due to gross of misconduct) has a formality to achieve terminating of my employment in a disciplinary manner.

Till the moment of accusation, I had little if any knowledge of the company's ISO 27001.

Asking about details such as ISO 27001 appendix A where it states as follows

A.5.1 Information security policy Objective: To provide management direction and support for information security following business requirements and relevant laws and regulations.

A.5.1.1 Information security policy document

Control

An information security policy document shall be approved by management, and published and communicated to all employees and relevant external parties.

I was told that I should have been aware of the policy as it is A daily Jira process.

My further concern is that ISO 27001 was used as a tool to conduct the process procedurally.

The investigation has finished with the letter of termination within three days notice period. I can make an appliance to the company owner within seven days.

What are the steps I can take in this situation?

Edit @Myles

That probably makes a strong case for constructive dismissal

My worry is Data Breach allegations leading to my dismissal. Fortunately, I had no access to production data in this company, but from previous experience, such access is sometimes necessary to carry on daily tasks.

I am concerned how this allegation may deface me in the eyes of my future employers.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Snow Nov 2 '18 at 14:48
  • "Constructive Dismissal" would be them unfairly creating a situation where you feel you need to resign. Disproportionate or incorrect disciplinary action falls into this. If they do fire you based on incorrect disciplinary action then it would be a case of Unfair Dismissal instead. Your citizen's advice bureau will be able to run through the specifics with you. – Myles Nov 2 '18 at 15:44
  • Sorry missed the fact that termination was a fact rather than a threat. This situation is not constructive dismissal as they've actively terminated you. Talk to your citizen's advice bureau about if this qualifies as unfair dismissal. – Myles Nov 2 '18 at 15:53
  • Internet access point. what exactly do you mean here ? did you have the owners instruction in writing ? and where you represented at your disciplinary hearing ? – Neuromancer Nov 2 '18 at 23:21
6

An information security policy document shall be approved by management, and published and communicated to all employees and relevant external parties.

This is a company responsibility to communicate this policy to all required parties. I'm assuming that you have never signed any documents stating that you have read policies when you have in fact not read them. If this assumption is true then they are firing you based on non-adherence to a policy that they never informed you of but were required to. That probably makes a strong case for unfair dismissal. I'd advise contacting your citizens advice bureau for the best path forward.

  • unless OP signed off saying they read the policy when you first started. Most places make sign something (on paper or digitally) saying you read the policies. – SaggingRufus Nov 1 '18 at 17:23
  • 2
    @SaggingRufus If the OP signed off on reading the policies and can still say "Till the moment of accusation, I had little if any knowledge of the company's ISO 27001", they have absolutely made a grave mistake. – Myles Nov 1 '18 at 17:32
  • exactly my point. – SaggingRufus Nov 1 '18 at 17:47
  • This isn't constructive dismissal, this is just plain dismissal. Constructive dismissal is where you do something like make an employee's life so miserable that they quit. – Acccumulation Nov 2 '18 at 15:43
  • @Acccumulation Sorry you are correct, I had to re-read this. I thought the letter of termination was a threat not a reality. – Myles Nov 2 '18 at 15:48
3

I got permission from Company owner to conduct an examination.

Two months later I have been accused of a possible gross of misconduct

Sounds like you have no problems.

Just tell whoever accused you that you got the owner's permission. As long as the owner agrees, it's hard to argue with that.

  • If I understand the OP correctly they've already been fired. – jcm Nov 3 '18 at 7:41
1

From the discussion in the comments, it sounds like your company has not been following its Disciplinary Policy (as well as not communicating Security Policy effectively to staff).

In a way, it's a shame your colleague wasn't discouraged by senior staff to attend the second meeting - this information would possibly play very well for you at an employment tribunal. Even so, the idea that you didn't know (and weren't advised) they could have been there for the Investigatory Meeting is a significant point against the way the company has handled things.

Your letter to the company owner (within 7 days), reminding them of your earlier discussion, will be a chance for the company to redeem themselves.

Otherwise, document everything and consult with legal representation (as Myles said, the Citizens' Advice Bureau is a good place to start). If the company has behaved the way it appears, saving your job might not be the best outcome - and if a future employer is concerned about the allegation of Data Breach, having an industrial tribunal rule in your favour will be a good way to mitigate this.

  • Not following standard discipline procedures is an automatic win for the employee – Neuromancer Nov 2 '18 at 23:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.