Unauthorised remote access? Manager wins case after employer's digital evidence falls short

FWC awards compensation after finding employer's technical investigation lacked concrete proof

Unauthorised remote access? Manager wins case after employer's digital evidence falls short

The Fair Work Commission (FWC) recently dealt with an unfair dismissal claim where a worker denied allegations of deleting company data and emails from her employer's computer system. 

The worker maintained she did not remotely access any systems on the day in question, arguing that she was at home with her sister after visiting her doctor due to a panic attack. She offered to have her laptop examined to prove her innocence, but the employer declined this offer. 

The case raises questions about evidence standards in misconduct allegations, procedural fairness in dismissal processes, and the responsibilities of employers when investigating potential misconduct before terminating employment. 

Worker’s unfair dismissal claim  

The worker was employed by a real estate agency from November 2023 to September 2024. She initially worked as a business development manager on a commission-only basis before becoming a property manager in February 2024. 

As a property manager, she was responsible for managing all aspects of rental properties for various clients. She worked both from the employer's office and remotely from her home in New South Wales. 

On 23 July 2024, the worker received a written warning during a staff meeting in front of other employees. The FWC noted the worker "had no notice or prior opportunity to respond to the allegations made, and conclusions reached, in the warning." 

The warning lacked specifics, containing only vague references to "previous meetings, emails & discussions" and a direction to "improve [her] conduct," without clarifying which policies she had allegedly violated. 

Computer access evidence examined 

On 26 August 2024, the worker left the office at 2:00 PM for a rental inspection. She suffered a panic attack while driving and instead visited her doctor. After her appointment ended at 3:02 PM, she went home with her sister. 

The employer alleged that at 3:26 PM, someone remotely logged into the worker's account using the company's two-factor authentication software "Duo" installed on her personal mobile phone. 

According to the employer, this access resulted in deleted emails, calendar entries, and documents, plus a redirection rule for emails. The worker denied these claims, stating she was drinking with her sister and didn't use her phone or laptop. 

The FWC identified significant problems with the employer's case: "The evidence of [the IT consultant] does not include any underlying information or data to show that the Deletion even occurred, let alone what was deleted, or what was recovered." 

Adding to concerns about the evidence, the IT consultant claimed the worker's phone had password protection, which the worker denied ever setting up. 

Dismissal process issues 

On 2 September 2024, without prior notice, the worker was called to a meeting where these allegations were presented. Despite her denials and offer to have her laptop examined, she was immediately dismissed. 

The FWC found the worker wasn't given proper notice of the allegations or adequate time to prepare responses. The Commission emphasized that dismissals require a valid reason related to capacity or conduct. 

In this case, the FWC concluded: "I do not accept that [the employer] has proven on the balance of probabilities that [the worker] conducted the Deletion on 26 August 2024, or on any other date, or that she otherwise set-up a redirection rule on her work emails." 

The FWC criticized the employer's refusal to examine the worker's laptop: "[The employer] had no logical or rational explanation for rejecting [the worker's] offer to examine her laptop." This examination could have determined whether the laptop was used to access the employer's system. 

The decision ultimately found: "In view of the findings and conclusions set out in this decision, I find that [the worker's] dismissal was harsh, unjust and unreasonable (i.e. unfair)." 

Compensation awarded decision 

The FWC determined reinstatement was inappropriate as neither party sought it. Instead, the Commission ordered compensation based on the period between dismissal and new employment. 

"I find it appropriate to grant [the worker] a compensation amount that is equivalent to the income that she would have received had she not been unfairly dismissed by [the employer], being the time between her termination on 2 September 2024, and up until 23 October 2024," the Commission stated. 

The compensation amounted to six weeks' pay ($9,230.82), less the one week's notice period already paid. 

The FWC stressed that this outcome aligned with the "fair go all round" principle from the Fair Work Act: "In my judgment, the outcome in this case is consistent with the object of Part 3-2 of the Act of providing a 'fair go all round' to both [the worker] and [the employer]." 

For allegations involving technical matters like computer access and data deletion, the FWC said that employers must present specific and cogent evidence rather than relying on assumptions or incomplete technical reports.