INM says it could take action against former chairman over breach
INDEPENDENT News & Media (INM) has said it may take action against its former chairman Leslie Buckley and others arising out of the major suspected data breach at the company.
The company has also criticised the Office of the Director of Corporate Enforcement (ODCE) for not telling it sooner about suspicions the data of journalists and former staff and directors was “interrogated” at the direction of Mr Buckley.
The stockmarket-listed firm has blamed the ODCE for a fall in the company’s share price since there has been an application to have inspectors appointed to investigate the newspaper publisher. Court documents show INM said there had also been an unusually high volume of trading in the company’s shares since the announcement.
In court papers, INM director Dr Len O’Hagan said the IT back-up tapes at the centre of the controversy were “decommissioned and destroyed” weeks before the ODCE alerted the company about the matter.
Following a year-long investigation, ODCE director Ian Drennan last month alleged the magnetic tapes were removed from INM’s premises in October 2014 and were “interrogated”.
Mr Drennan said the ODCE had found a list of 19 names, including high-profile journalist Brendan O’Connor, believed to have been used during a search of the data. He alleges the operation was directed by Mr Buckley, while invoices associated with it were paid by a company beneficially owned by INM’s largest shareholder, Denis O’Brien.
Mr Buckley and Mr O’Brien are close business associates. Mr Buckley, who stepped down last month, has pledged to robustly defend his position, but Mr O’Brien has yet to comment.
The ODCE is seeking the appointment of High Court inspectors to investigate the suspected data breach and other corporate governance issues at INM. But in his affidavit, Dr O’Hagan argues the Data Protection Commissioner is best placed to investigate and that the appointment of inspectors would be “unnecessary and disproportionate”.
Dr O’Hagan said INM was “deeply concerned” there might have been improper searches.
“The board will take any steps that may be necessary and appropriate having considered all matters, including if necessary action against its former chairman and/or any other persons involved,” he said.
The destruction of the backup tapes occurred “in the weeks prior” to the ODCE issuing proceedings for the appointment of inspectors. Dr O’Hagan said this was done as part of “housekeeping” ahead of the introduction of GDPR regulations, which impose stringent requirements on organisations to not retain data unnecessarily. Dr O’Hagan said the ODCE had information about the alleged data interrogation for six months, but did not inform INM until March.
Tapes
Had INM known about it, the tapes would have been “ringfenced”, he said. It was not clear that the tapes would have contained any useful information as they had been overwritten a number of times in the normal course of business, he added.
Dr O’Hagan said when former INM chief executive Robert Pitt made a protected disclosure to the ODCE in August last year about the suspected data breach, the board sought assurances from Mr Buckley. The then chairman told the board he had been engaged in a “cost reduction exercise” and was seeking information about a contract, with a view to seeing if it could be renegotiated. Dr O’Hagan said INM relied on this reassurance and that it was “unfair” of Mr Drennan to criticise the company “for failing to react properly”.
He said Mr Drennan’s affidavit appears on its face to cast doubt on Mr Buckley’s account. “If it is established that the concerns identified by Mr Drennan in this regard are accurate then it is clear the board was misled by its former chairman,” he said.
Meanwhile, Dr O’Hagan said the company was “not asserting” that the sharing of information by Mr Buckley with Mr O’Brien “was in every respect appropriate”. However, he said there was “a difference in view” between INM and the ODCE as to the extent of permitted communications between the two men.
The ODCE wants inspectors to investigate if various communications amount to a breach of EU market abuse regulations.
Dr O’Hagan said nominee directors are expected to share information with their nominating shareholder, where this is done in a manner consistent with fiduciary duties and applicable legal and regulatory requirements. He also said there was no suggestion from the ODCE that information was used by Mr O’Brien in dealing in INM securities or for other unlawful purposes.