Questions raised over NHS deletion of thousands of emails during whistleblower tribunal

'Extraordinary' disclosure practices

An unsigned witness statement submitted to the tribunal for Cocke claimed the voluminous electronic documents had been “permanently” deleted. LGT has since claimed, however, that the 90,000 emails alongside additional electronic documents were recovered and submitted to the tribunal. Day disputes this.

Cocke’s actions followed LGT’s late disclosure of more than 200 pages of documents. The tribunal heard that the documents suggested the trust’s CEO Ben Travis had given “inaccurate” and potentially misleading evidence to the tribunal days earlier.

Day’s barrister Andrew Allen told an employment appeal tribunal on 27 February 2024 that Cocke went "in the middle of the night and destroyed them...because he was in a panic".

According to Allen, Cocke "had been observing the case and realised that key evidence had not been disclosed". That Cocke "destroyed documentation potentially relevant to the litigation,” Allen argued, “is intimately tied up with" Day's concealment and detriment claims.

He added there was a “failure to make findings” at the 2022 tribunal on the attempted destruction of this electronic evidence.

Appeal tribunal judge Andrew Burns described Cocke’s conduct as “extraordinary”. He noted in his judgment in February 2024 that “although the employment tribunal has mentioned that it can draw adverse inferences… from the respondent’s deletion of documents, it doesn’t seem to have turned its mind to doing so.”

Allen also raised questions about LGT’s destruction of electronic records prior to the 2022 hearing.

"Documents had not been sought from key personnel,” he said, including from Janet Lynch - an ex-workforce and education director at the trust, who, as its instructing client, had been responsible for instructing the trust’s solicitors in the case up until late 2018. “And key documents [including Lynch’s emails] were destroyed after she left the trust.”

'Very irregular'

Experts in digital evidence discovery have questioned LGT’s court claims that emails and other e-archives were “permanently” deleted in July 2022. No IT experts were present at the 2022 tribunal or last month’s appeal tribunal to assess the trust’s claims concerning destroyed evidence, including whether any potentially outstanding electronic documents were still recoverable. 

Martin Nikel, an expert in e-discovery who heads Thomas Murray's Cyber Risk Advisory e-discovery and litigation support practice, told Computer Weekly that a number of key questions regarding the emails’ status had not been answered by the tribunal or LGT.

"It's very irregular for a director of communications to have the ability to permanently delete emails without administrative privileges,” he said.

“When it's said that he deleted 90,000 emails, that's potentially a big task to undertake. In these scenarios, an end-user without significant knowledge and access rights would leave three potential sources of email, which could be explored to see if the email can be recovered.”

One source, he said, was local offline storage, whereby, “Emails are cached on the local machine in an offline storage file (OST) which, even when emails are deleted from the mailbox, can leave fully recoverable items, unless the OST file is forensically destroyed.

“Other emails may have been archived off into different locations available to the individual.”

If the system in use at LGT was NHSmail, Nikel said, it is likely the emails would have been retained for a minimum of 30 days and possibly up to two years: “A forensic discovery request to the IT administrators would have put a legal hold on the account to prevent any automated permanent deletion, and the retained emails could have been recovered.”

Nikel added, “The same administrators could perform a search across the entire Microsoft 365 environment to establish the presence of any of these emails in other user mailboxes and non-email storage locations. It is not clear to me which, if any, of these steps were explored.”

Lack of rigour

Nikel said the retention period depended on whether the emails had been sent via NHSmail, a centralised system administered by Microsoft, or a more locally-managed LGT system.

When asked by Computer Weekly what IT systems were in place at LGT both now and in 2022, a trust spokesperson said: “We only use NHSmail, which colleagues can also access through Outlook.”

The NHS’s data retention and information management policy states that “an email will be retained and available for forensic discovery in NHSmail for two years after it was received/sent or until it is deleted from the mailbox, whichever is later.”

Under the Microsoft 365 software in use at most NHS hospital trusts, the policy said, “Emails are not automatically deleted after two years unless a user has manually deleted them from their mailbox.”

Reliability of evidence

Nikel added that the way in which LGT board members were asked to provide evidence for the 2022 hearing was “unreliable”.

“It appears that board members were instructed to simply search their own emails,” he said.

“This is an obviously unreliable way to perform any collection of evidence in a neutral way. The NHS has processes in place for such situations - and organisations like the Counter Fraud Authority - that I am sure could provide better evidence handling processes in such high-profile matters.

“Legal advisers could appoint external forensic experts, which if nothing else, would help with perception in future situations such as these.”

Employment tribunals less rigorous

Robert Maddox, an employment lawyer with Doyle Clayton, said that an employment tribunal will broadly apply the same evidence disclosure and preservation rules as the civil courts.

“But it doesn’t have the same level of rigorous procedure that goes with a High Court matter,” he said.

“For example, in the civil courts, a party can be obliged to complete a disclosure certificate of compliance confirming where they’ve searched, what they’ve searched for, confirming they’ve disclosed all relevant documents.

“That’s not necessarily done in the tribunal. There is an obligation on parties to perform a reasonable search and to disclose any documents that are relevant, irrespective of whether they are favourable or adverse for a party’s case.

“But there certainly is an obligation to preserve documents and tribunals will look unfavourably on documents having been lost or destroyed.”

Maddox added that, although it is possible to enlist an IT expert to assess issues relating to lost or deleted evidence, tribunals can also take a party’s statements about evidence disclosure and existence at face value.

It is currently more common for a party to make submissions on adverse inferences that can be drawn from missing, lost or deleted evidence, he said, rather than incur additional cost or risk further delays to proceedings.

Appeal tribunal ruling

Among the grounds of appeal dismissed by the appeal tribunal ruling was alleged concealment, meaning the emails and other electronic documents Cocke was said to have destroyed are unlikely to be scrutinised at the full appeal hearing.

An appeal tribunal will now consider a number of challenges to the 2022 ruling, including questions of whether a series of online public statements the trust issued about Day caused him detriment.

Four of Day’s eight grounds of appeal were accepted by an appeal tribunal last month, which found they were “arguable” and should proceed to a full hearing. He has since applied for a review of the decision and for an additional ground to be added to his appeal.

Day was also granted the right to recover costs for the British Medical Association, which lent financial backing to his 2022 tribunal case.

Day said he was disappointed by Burns’ decision, which he believes has “watered down” his appeal case. He said, “The legal system has ignored large amounts of evidence and even allowed evidence to be destroyed on more than one occasion to avoid having to deal with the facts in this case.”

A LGT spokesperson said it noted the outcome of the appeal hearing, “but will not be commenting further at this time as legal proceedings are ongoing.”

LGT declined to answer questions as to whether Cocke still works at the trust in any capacity and whether it has funded his legal costs, after he enlisted the services of a separate firm to fight his corner during the 2022 tribunal hearing. Travis remains the trust CEO.

No in-person representations were made at the February hearing. However, solicitors Capsticks made separate submissions to the tribunal on behalf of LGT.

Read more about Chris Day’s case  

November 2022: NHS trust that deleted up to 90,000 emails cleared of deliberately concealing evidence

July 2020: NHS trust ‘deliberately’ deleted up to 90,000 emails before tribunal hearing