Employee responsible for ‘non-malicious’ data breach loses unfair dismissal case

An employee who was terminated for a breach of company confidentiality and data security had her unfair dismissal case tossed after the Fair Work Commission ruled it was serious misconduct.

Vickie McKenney’s employment was terminated with Rainbow Palm on 9 May 2025 after her employer alleged that she committed a “serious breach of her obligations to comply with Rainbow Palm’s internal privacy and confidentiality policies”, Fair Work commissioner Scott Connolly found.

Following her termination, McKenney made an unfair dismissal application on 24 May 2025, submitting that she did not have any malice or intent behind her conduct and did not consider that her actions amounted to a breach of her obligations as an employee.

Despite her submissions, Connolly ruled that her termination was not unfair, tossing her unfair dismissal application.

Two warnings later

McKenney commenced working for her employer in 2018, preparing meals in the kitchen for residents at an assisted living facility.

On 14 April 2025, Rainbow Palm issued McKenney with a formal warning after she failed to complete the required first-aid and CPR training. McKenney submitted that she was unable to complete this training as she had been working long hours and had not been provided the time to.

On 28 April 2025, McKenney completed the training but had not yet received her certificate of completion. As a result, her employer issued her a second formal warning for “failing to provide evidence of booking or completing the required training”, which could lead to further disciplinary action, including possible suspension or termination, the commissioner heard.

McKenney submitted that she thought the second formal warning was unfair – she recalled feeling unwell and that she did not attend work for extended periods after 29 April 2025 due to the stress of receiving this warning and being threatened with dismissal.

McKenney gave evidence that she thought that she had approved sick leave for this period; however, her employer submitted “no understanding” of this planned absence, the commission heard.

‘Loyalty and strengths’ report

The commission heard that on 5 May 2025, McKenney plotted to put together a “loyalty and strengths” report to give to her employer, as she felt that at the time, she was “under attack and fearful she was going to be dismissed”.

Rainbow Palm gave evidence that 198 emails – including around 80 per cent of client data – were transferred from McKenney’s work email to her personal email in an attempt to compile this report to fight her case.

Following the discovery of this data breach, her employer initiated an investigation, leading to a request to return all company property in her possession on 8 May 2025, advising her that she was to find out the outcome of the investigation and the consequences for her employment the following day.

On 9 May 2025, McKenney was terminated effective immediately for a “serious safety breach of confidentiality and information security identified on the 5th of May, and subsequent failure to cooperate with company directives”, the commission found.

Despite Connolly accepting that McKenney was not acting with malice or intent, “the significance in the volume and substance of material Ms McKenney transferred cannot be overlooked”.

As a result, the commissioner found that there were sound and valid reasons for McKenney’s termination, rejecting her unfair dismissal application.

The case citation: Vickie McKenney v Rainbow Palm Pty Ltd (U2025/8981).