A former manager at the Financial Conduct Authority has alleged that he was fired after blowing the whistle on “a number of matters of serious wrongdoing” relating to the treatment of Freedom of Information Act requests, and that his manager conspired to get rid of him when he raised concerns, the Employment Tribunal has heard.
This site is financed by donations to the ‘Cheese Fund‘ or you can buy me a coffee here
Reporting by Daniel Cloake
Mr Ahmet Latif, 64, was an Information Disclosure Manager and Deputy Data Protection Officer at the city regulator from December 2019 until his termination in February 2023.
In his witness statement, deployed at the East London Employment Tribunal this week, Mr Latif described the Information Management team of 12 people, responsible for dealing with FOI and GDPR compliance, as “stretched and under-resourced” and that it “did not appear to have been effectively managed since 2017/2018“.
The Import Building – Home of the East London employment tribunal
The idea that the information disclosure department was in chaos was alluded to in an internal FCA report marked ‘private and confidential’, dated 31st January 2020:
The position is that considerable inefficiencies exist in the FCA’s administration of FOIA. To a significant degree these inefficiencies have become embedded in the practical and operational processes used by the information disclosure team.
In addition, teams like the CEO’s office and press office are making interventions in a significant number of cases in trying to ensure that damaging disclosures are not made and in some cases very significant time and effort is spent on trying to arrive at an agreed course of action, with excessive numbers of emails back and forth between various stakeholders, sometimes making the issues increasingly incomprehensible.
The evidence indicates that the FOIA process is not fit for purpose.
Another important and likely contributing factor in this appears to be the absence of clarity, direction and purpose.
The caseload is still substantially lower in comparison with others including local authorities, central government departments, the Metropolitan Police Service, NHS and other agencies.
The concept of departments “making interventions” is confirmed in an e-mail sent by Chris Garman, then the private secretary to Megan Butler, Executive Director of Supervision – Investment, Wholesale and Specialists (SIWS), just four weeks later:
Can I please underline – once again – how critical it is from our perspective that the FOI team properly involves both this office and the relevant Director’s office in relation to FOI requests pertaining to SIWS? As you will recall this is a point we have made repeatedly, and I am increasingly concerned and uncomfortable at the number of requests where this continues not to take place
In addition to the one below, I can think of at least 4 others that have come to our attention through the ‘wrong’ channel this week alone. … failure to follow agreed processes undermines both accountability for the accuracy/ appropriateness of responses to these requests, and also risks creating avoidable extra work for our teams through misleading or incomplete information being put in the public domain.
Georgina Philippou, then the FCA’s Chief Operating Officer, received a message from Mr Latif in February 2020. It said:
I have sought to be clear and open in saying that the FOIA service is simply not fit for purpose. The inefficiencies are endemic and affect not just the processes for ensuring organisation oversight and sign off (as noted below) but every aspect of operations and transactional activity; it is difficult to overstate how embedded and entrenched the inefficiencies are. I’ve advised Andy that very little meaningful quality assurance exists across most of the team’s activity.
A report entitled ‘The Big Reset’ was sent out in March 2020 stating that the authority was “struggling to process < 1,000 cases per year” but that the Metropolitan Police dealt with 4,500 with a similar size team. An ambition that the average costs of dealing with FOIA requests should decrease from £1,500 down to £300 was also shown.
Another e-mail in the 2,000 page hearing bundle talked about how “up to 8 sign-offs are needed for relatively routine FOIA requests“, a situation described as “inefficient” and “not particularly logical“.
The FCA’s General Counsel Division was also heavily involved in dealing with requests. A June 2020 report stated:
One of the most problematic occurrences was effectively the outsourcing of FOIA decision-making to GCD in a large number of cases. This was occurring on a weekly basis with GCD officers being appraised of cases in general terms and being invited to make comments.
Mr Latif said that “by August 2020 I had uncovered a particularly serious problem… that meant the FCA had effectively been operating the FOI scheme unlawfully for at least two and a half years“.
The problem related to the so-called Public Interest test under s10(3) of the FOI Act – normally public authorities have up to 20-working days to reply to a request but section 10 allows another 20 days to give the public authority time to consider the public interest test.
It was asserted this problem had the effect that “processing times for FOI requests was falsely inflated by a significant margin over this period; with actual performance being substantially lower than had been presented to the FCA Executive Committee and other stakeholders“.
When the figures were “recalculated to properly classify the unlawful FOI date extensions” it was said the percentage of compliant in-time requests dropped from 90% down to 68% in 2018/2019.
Mr Latif claimed “the [FCA’s] own specialist Risk & Compliance Oversight team undertook an investigation into the matter which conclusively confirmed my own uncovering and initial investigation of the issue“.
Indeed, a 19-page review of the time extensions issue dated June 2021 said that some 18 files had been analysed:
The primary focus of the work related to 18 cases received by the FCA between July and December 2020. Of these cases, we found that the time extensions were inappropriately used in 17 cases. In 1 case the time extension was used appropriately.
A “small sample” of six cases from 2018 and 2019 were examined revealing “5 inappropriately utilised a s.10(3) time extension“.
Most commonly, we have seen s10(3) extensions used in cases where further time is needed to consider the applicability of exemptions, rather than the public interest arguments for and against disclosure where an exemption has been confirmed as being engaged. This is expressly prohibited under ICO guidance.
… the extracts above support our finding that the starting point on information requests for many case owners is not the requirements of the FOIA and the applicability of exemptions, but on their own preference with regards to sharing or withholding the information.
The report concludes that “it appears more likely that these issues are structural rather than as a result of the action of individual case officers“.
Another report was produced in September 2022 which revealed that compliance was much better:
Since the introduction of the updated process and the ServiceNow system, the number of public interest extensions is extremely low. Fieldwork has not identified instances of the inappropriate application of extensions.
But, this didn’t mean that information was being disclosed any faster:
At the time of fieldwork completion, there were, however, a very high number of overdue FOIA cases. Over the audit period of May 2021 to Feb 2022 the number of open cases which were overdue increased significantly [from 35% in May 2021 to 60% in May 2022]
Blowing the whistle
In his witness statement Mr Latif said he “repeatedly raised a number of matters of serious wrongdoing directly with my line manager“.
The manager, Mr Andy Cobbett, left the FCA in December 2022 and is named as the second respondent in this claim.
The tribunal was told that Mr Cobbett “deliberately mislead the FCA with regard to the position, performance and priorities of the Information Disclosure Team service… This was about the deliberate and negligent failures to properly manage the freedom of information and subject access request schemes” and a “failure to comply with legal obligations”.
Mr Latif claimed that Mr Cobbett “invented” a poor performance case and placed him on an improvement plan after the raising of these “serious concerns“.
My line manager, Andy Cobbett worked to deliberately falsify and misrepresent certain targets for the PIP (performance improvement plan), in doing this, he retrospectively altered key targets that had already been agreed for my April 2021 to March 2022 performance year,
It appeared that Andy Cobbett was using the PIP to attack me in an inappropriate and improper way
Mr Latif said his boss had sent an e-mail to the COO, and another head of department that said he had “a bit of a habit of using alarmist language to make a point”. This was a “defamatory statement and an inappropriate and inaccurate way to have portrayed me“.
Mr Latif also contacted the FCA’s dedicated whistleblowing team and was disappointed with the response.
Kevin Basmadji, the then Head of Resourcing and Talent at the FCA, said he had “explained to the clamant that he was entitled to blow the whistle if he felt he needed to, but I did highlight with him that he would be raising whistleblowing concerns about the IDT, the team that he was managing and responsible for.“
The tribunal was told Mr Latif then contacted “the most senior stakeholders in the FCA“, including Charles Randell, board chair, and Nikhil Rathi, CEO, “regarding the fact that the FCA’s whistleblowing process does not work effectively and the process lacks assurance“.
Mr Latif said “in these emails I raised very serious concerns about the failure of the process; that I was being victimised and subjected to unlawful detriment since making whistleblowing protected disclosures”. Adding: “I received no acknowledgement or response from these senior
stakeholders to any of the five emails I sent.“
Project Stone
In order to preserve evidence related to his whistleblowing concerns Mr Latif said he started sending information from his FCA e-mail account to his personal Gmail account.
This sending of information was discovered by the FCA’s cyber and information resilience team as part of ‘Project Stone’ which had identified some 43 “relevant individuals” who had received either 100 e-mails or 100MB of data to their external email address. Mr Latif was one such person who had apparently sent over 300 e-mails to himself.
The FCA say 103 of these emails were sampled and 13 were found to have contained ‘red’ or sensitive material.
During cross examination of Mr Latif, barrister Ms Jude Shepherd, representing the FCA, raised the contents of the first e-mail, dated 7th October 2021, said to contain a presentation about the FCA’s strategic security program. Apparently detailing the FCA’s top 4 cyber risks Ms Shepherd put to the claimant that this “highly sensitive document…could be extremely damaging” were it to get out into the open. “Yes, but no control was lost was it” replied Mr Latif.
In his witness statement Mr Latif suggested that his suspension, and ultimately his dismissal from the FCA, was “an unnecessary act and an over-reaction” on the basis of the sent e-mails. He drew attention to the FCA handbook on misconduct to illustrate the point.
We were told this stated that “a breach of the information and systems acceptable use policy is specifically noted as “general misconduct” and not “gross misconduct.”“
Tribunal documents also contained reference to a ‘Person M’, described as a senior manager. There was a “concern that [redacted] final report on [redacted] was shared with media, without authorisation” and that they may have run “a twitter account – for purpose of leaking documents and unfair/adverse comments about [the Executive Committee]“. It is said M received a final written warning.
The background to ‘Project Stone’ was detailed in the witness statement of Andy Cobbett. He says:
As chief information security officer part of my duties was to investigate cyber security incidents and data breaches. In late September/ early October 2021, the organisation had been investigating a leak of information, unrelated to the claimant.
The original incident arose immediately after I went on leave. John was deputising for me and I specifically remember him calling to notify me and us joking that the my new motor home had just become the FCA’s new unofficial mobile command centre
There was a general concern that there may be other instances of such data leaks.
The respondents’ respond
In their Grounds of Resistance spanning 20-pages, authored by law firm Bevan Brittan LLP, dated 9th June 2023 both the FCA and Mr Andy Cobbett denied any and all accusations of wrongdoing.
They say that concerns were raised about Mr Latif’s performance in the role citing his “lack of understanding of basic change theory or project management” and that he had “a lack of basic line management skills… [and] failed to take accountability for the performance of his team.“
The FCA say that there was “little tangible service improvement in the 5 months the claimant had been in post as a result” and that “these performance concerns were shared by the COO“.
[Mr Latif] was also raising concerns about his own team and the FOIA and SAR requests they were responding to, which included a failure to comply with regulatory requirements under the Freedom of Information act but failing to take action to address the issues he was raising.
These issues were well known to [Mr Cobbett] and senior management as these were the issues that the claimant had been recruited to address. It is denied that there was any failure by [Mr Cobbett] to ensure senior stakeholders were aware of the matters
It is denied that [Mr Cobbett] had been working to create a case of underperformance without the claimants knowledge and where no such underperformance had existed.
It is denied that [Mr Cobbett] worked to deliberately falsify and misrepresent certain targets for the PIP by retrospectively altering key targets that had already been agreed with the claimant.
[Mr Cobbett] left the first respondents employment on 1st December 2021 and could not have been (nor was he in any event) involved with or responsible for, the claimants dismissal.
The FCA also say:
“It is denied that the claimant suffered any detriment, as alleged or at all, because he made a protected disclosure, or at all“, and in any event four of the alleged detriments “are time-barred” and should not even be considered by the tribunal.
As to the remaining alleged detriments the FCA say:
it is expressly denied that the claimant was dismissed for the reason or principle reason that he had made protected disclosures, and it is expressly denied that the decision to dismiss him, the investigation and disciplinary processes were because of, motivated or tainted by, the alleged or any protected disclosures made by the claimant.
As to the finding of gross misconduct following the sending of ‘sensitive’ e-mails the FCA say:
The policy makes clear that the examples of misconduct and gross misconduct listed are not exhaustive. The allegations against the clamant were very serious and other employees who had also been identified as sending confidential and sensitive documents outside of the [FCA] were also suspended following allegations of gross misconduct being made. The respondent therefore avers that this was a reasonable course of action to take.
Prior to the writing of this article the FCA declined to provide their written submissions to the mouseinthecourt with a spokesperson telling us “the FCA is fully engaging with the Employment Tribunal and there is no further comment at this time.“
You can read our previous coverage of an FCA employment tribunal case in “Did internal politics and a culture of confusion at the FCA fail P2P investors?“
Mr Latif’s claim at the East London Employment tribunal for reinstatement to his former role, and compensation totalling £115,981, began on Tuesday 18th March 2025 and is listed to last some 14 days.
Employment Judge Sophie Park is expected to hand down the tribunal’s decision in April 2025.
The FCA and Mr Andy Cobbett are represented by barrister Jude Shepherd. Mr Latif appears unrepresented as a litigant in person.
The hearing continues.
Mouse in the Court 