Questions raised over NHS deletion of thousands of emails during whistleblower tribunal

Day’s barrister Andrew Allen told an employment appeal tribunal on 27 February 2024 that Cocke went “in the middle of the night and destroyed them…because he was in a panic”.

According to Allen, Cocke “had been observing the case and realised that key evidence had not been disclosed”. That Cocke “destroyed documentation potentially relevant to the litigation,” Allen argued, “is intimately tied up with” Day’s concealment and detriment claims.

Appeal tribunal judge Andrew Burns described Cocke’s conduct as “extraordinary”. He noted in his judgment in February 2024 that “although the employment tribunal has mentioned that it can draw adverse inferences… from the respondent’s deletion of documents, it doesn’t seem to have turned its mind to doing so.”

Allen also raised questions about LGT’s destruction of electronic records prior to the 2022 hearing.

“Documents had not been sought from key personnel,” he said, including from Janet Lynch – an ex-workforce and education director at the trust, who, as its instructing client, had been responsible for instructing the trust’s solicitors in the case up until late 2018. “And key documents [including Lynch’s emails] were destroyed after she left the trust.”

Martin Nikel, an expert in e-discovery who heads Thomas Murray’s Cyber Risk Advisory e-discovery and litigation support practice, told Computer Weekly that a number of key questions regarding the emails’ status had not been answered by the tribunal or LGT.

“It’s very irregular for a director of communications to have the ability to permanently delete emails without administrative privileges,” he said.

“When it’s said that he deleted 90,000 emails, that’s potentially a big task to undertake. In these scenarios, an end-user without significant knowledge and access rights would leave three potential sources of email, which could be explored to see if the email can be recovered.”

One source, he said, was local offline storage, whereby, “Emails are cached on the local machine in an offline storage file (OST) which, even when emails are deleted from the mailbox, can leave fully recoverable items, unless the OST file is forensically destroyed.

“Other emails may have been archived off into different locations available to the individual.”

If the system in use at LGT was NHSmail, Nikel said, it is likely the emails would have been retained for a minimum of 30 days and possibly up to two years: “A forensic discovery request to the IT administrators would have put a legal hold on the account to prevent any automated permanent deletion, and the retained emails could have been recovered.”

Nikel added, “The same administrators could perform a search across the entire Microsoft 365 environment to establish the presence of any of these emails in other user mailboxes and non-email storage locations. It is not clear to me which, if any, of these steps were explored.”

Nikel said the retention period depended on whether the emails had been sent via NHSmail, a centralised system administered by Microsoft, or a more locally-managed LGT system.

When asked by Computer Weekly what IT systems were in place at LGT both now and in 2022, a trust spokesperson said: “We only use NHSmail, which colleagues can also access through Outlook.”

The NHS’s data retention and information management policy states that “an email will be retained and available for forensic discovery in NHSmail for two years after it was received/sent or until it is deleted from the mailbox, whichever is later.”

Under the Microsoft 365 software in use at most NHS hospital trusts, the policy said, “Emails are not automatically deleted after two years unless a user has manually deleted them from their mailbox.”

Nikel added that the way in which LGT board members were asked to provide evidence for the 2022 hearing was “unreliable”.

“It appears that board members were instructed to simply search their own emails,” he said.

“This is an obviously unreliable way to perform any collection of evidence in a neutral way. The NHS has processes in place for such situations – and organisations like the Counter Fraud Authority – that I am sure could provide better evidence handling processes in such high-profile matters.

“Legal advisers could appoint external forensic experts, which if nothing else, would help with perception in future situations such as these.”

Maddox added that, although it is possible to enlist an IT expert to assess issues relating to lost or deleted evidence, tribunals can also take a party’s statements about evidence disclosure and existence at face value.

It is currently more common for a party to make submissions on adverse inferences that can be drawn from missing, lost or deleted evidence, he said, rather than incur additional cost or risk further delays to proceedings.

An appeal tribunal will now consider a number of challenges to the 2022 ruling, including questions of whether a series of online public statements the trust issued about Day caused him detriment.

Four of Day’s eight grounds of appeal were accepted by an appeal tribunal last month, which found they were “arguable” and should proceed to a full hearing. He has since applied for a review of the decision and for an additional ground to be added to his appeal.

Day was also granted the right to recover costs for the British Medical Association, which lent financial backing to his 2022 tribunal case.

Day said he was disappointed by Burns’ decision, which he believes has “watered down” his appeal case. He said, “The legal system has ignored large amounts of evidence and even allowed evidence to be destroyed on more than one occasion to avoid having to deal with the facts in this case.”

A LGT spokesperson said it noted the outcome of the appeal hearing, “but will not be commenting further at this time as legal proceedings are ongoing.”

LGT declined to answer questions as to whether Cocke still works at the trust in any capacity and whether it has funded his legal costs, after he enlisted the services of a separate firm to fight his corner during the 2022 tribunal hearing. Travis remains the trust CEO.

No in-person representations were made at the February hearing. However, solicitors Capsticks made separate submissions to the tribunal on behalf of LGT.