The transcripts of the official inquiry into the culture, practices and ethics of the press. More…


  • Please make yourself comfortable.

    Could you confirm your full name, please?

  • You have provided a statement to the Inquiry; are the contents true and correct to the best of your knowledge and belief?

  • Ms Brady, thank you very much indeed for providing such a detailed account of the events with which we are just about to deal. I have no doubt that when this Inquiry was set up you never in your wildest dreams imagined you would have to contribute to it.

  • No, not even in my wildest dreams.

  • You are Virgin Atlantic Airways' general counsel and director of human resources and external affairs, is that right?

  • You are a qualified solicitor. You sit on the management board and oversee the government affairs, legal and sustainability departments?

  • You initially started working for Virgin Atlantic as long ago as 1994 as a legal adviser. There was a break between 2000 and 2003, after which you returned to Virgin Atlantic, and you have been general counsel since 2007 and in your current expanded portfolio since 2009?

  • Now, your company was contacted, you tell us, on 4 April of this year?

  • Your press office was contacted by a journalist from the Guardian newspaper who said that he had a story about the flight details of some of Virgin Atlantic's high profile passengers being provided by one of your employees to a well known paparazzi agency, Big Pictures, is that right?

  • The journalist provided to Virgin Atlantic a copy of an email dated on or around 29 June 2010 between a person at Big Pictures and a person operating a Yahoo! email account, is that right?

  • In order to be clear, that if we are cautious about naming names or going too far into it, it is because I have absolutely no wish to undermine or in any way impair any criminal investigation.

  • The email that was provided to you on 4 April suggested that the flight details of eight celebrities were listed.

  • The journalist alleged that the author of the email was one of your employees and that person we will just call S. S was identified to your company?

  • And amongst the information provided in the email, and you have appended the email string to your witness statement as JAB1, if we turn to that, at the bottom of page 2 there is just one passage in particular I would like to go to. It is from a person at Big Pictures to S:

    "Just trying to sort you out some money with accounts."

  • So was the impression that you had formed that money might have changed hands?

  • That certainly seems to be the suggestion in this email.

  • What was Virgin Atlantic Airways' corporate reaction to this development?

  • This was certainly something that we were taking very seriously. Initially we received the email at the same time the employee, or shortly beforehand the employee had been contacted by the same journalist, and they had reported the matter to their manager and also to the press office. So we were hearing this from two different places. We took it, immediately, very seriously and began an investigation.

  • In the course of that investigation is it right that S was spoken to?

  • Yes. It seemed the most logical place to start was to speak to the person concerned.

  • And S denied any wrongdoing?

  • At that stage, on 4 April, were you able to ascertain whether or not the data which had been provided to you was genuine flight data or not?

  • We started that piece of work. It took us a little bit of time and -- but we were only able to confirm that the following day.

  • When you had confirmed that it was genuine data, what did Virgin Atlantic Airways decide to do?

  • As soon as we realised that it was data that must have come -- or could quite possibly have come from our systems, we reported the matter to the information commissioner's office.

  • Yes, we self-reported.

  • Did you consider that to be the act of a responsible company?

  • Did you report it to anybody else?

  • Later, once the second batch, the second lot of information was provided to us, we also reported it to the police.

  • You say in your statement that the other thing you did at that stage was attempt to contact the eight passengers?

  • Identified in the emails. I don't want you to identify any of those persons, but can you tell us whether at that stage you were successful in contacting them?

  • I don't believe we were successful.

  • You then tell us at paragraph 14 of your witness statement that S resigned, although at that stage without saying anything further about the allegations?

  • On the evening of 5 April the Guardian published an article about the story on its website and then the day after, on the 6th, on the front page of its print edition; is that right?

  • You were then contacted by the Press Gazette, who provided further emails to you relating to flights in March 2011; is that right?

  • I think they claimed that they were flights in March 2011. I think in the emails that followed it is not clear what the dates of all of the travel arrangements were.

  • This second batch of information concerned, didn't it, a much larger number of celebrities, 63 in total?

  • And the Press Gazette were alleging that they had been sent to the same person at Big Pictures?

  • And those allegations were then put into the public domain very vividly on 7 April 2012 through a number of media, weren't they?

  • Faced with the results of your initial investigation, what did Virgin Atlantic then do?

  • Well, at that stage we -- although we were aware that this information could well have come from our own systems the individual concerned who had resigned was still denying the allegation and so we felt it was appropriate for us to continue our investigation, and we did so.

    We spoke to other staff members in the area where it was alleged this information had come from. We also conducted searches of email accounts to find out whether there had been any contact from our organisation using our systems to the Big Pictures agency; those were the sort of steps we took in terms of our investigation.

  • And had Virgin Atlantic emails been used for this contact or not?

  • Not as far as we could find.

  • And did any of the other members of the Upper Class support team who you interviewed tell you anything of interest?

  • No, they didn't. They had no knowledge of the allegations that were made.

  • You then tell us that S was re-interviewed on 16 April 2012?

  • Yes. We had written to her, since her time leaving us, and she had agreed to meet us.

  • On that occasion is it right that S was more forthcoming?

  • She was. She agreed or confirmed that she had in fact written the emails concerned.

  • Have you been able to confirm the full extent of the data losses or not?

  • No. We haven't. The individual concerned said that she had deleted all of the emails that she had sent from her home account and that she had closed down the account. She thought, she said, that the emails that we were able to show her probably did amount to the totality of what she had done, but she couldn't be sure.

  • There has been an allegation that John Yates' flight details may have been leaked to the media and there was an article published by the Mail on Sunday. As a result of the investigations that Virgin Atlantic have done, are you able to say what the position is with that allegation?

  • We haven't seen anything that would lead us to believe that that was the case, and I think probably that the media reports -- from the media reports, we see that the Mail on Sunday have said that this was not based on information from Virgin Atlantic.

  • Moving now to the protective systems that were in place at Virgin Atlantic at the time that these data losses occurred, you tell us first of all that there are contractual obligations of confidentiality written into contracts of employment; is that right?

  • And that there are three relevant policies: a professional standards policy, the information security policy and a data protection policy?

  • You tell us a little bit at paragraphs 23 and 24 of your witness statement about some of the training and quality checking systems which are in place, and in particular that there are 17 members of the Upper Class support team, all of who have training above and beyond the norm; is that right?

  • Could you perhaps put that into context? How does Virgin Atlantic Airways go about deciding who needs data protection training and how much?

  • Indeed. There are many, many people in our organisation who need access to passenger information in order to do their jobs. That can be from the call centre when you make a booking, going back to that call centre when you want to change that booking, speaking to people in our loyalty department who deal with the frequent flyer accounts, our refunds department who might need to have access to booking information, the airports who are checking you in, our people who are arranging limousine transfers for people. You know, anything from a customer relations team. So there are many people in our organisation who need to have access to our customers' information in order to do their jobs effectively and to provide the service that our customers expect to get.

    We take, therefore, across the business, an approach of making it abundantly clear that confidential information is important and that it should not be disclosed. The three policies that you have seen make that clear, and actually, re-reading those policies, they overlap each other considerably. The professional standards policy really talks about how we expect people to conduct business in general and one of its parts is it talks about the confidentiality and security of information; not disclosing it, not discussing it with people who don't need to know it and not discussing it in public places.

    Then through to the data protection policy, which is very clear about the requirements of the Data Protection Act, what constitutes personal information under that Act, what constitutes sensitive personal information, and then goes on to set out practical examples of scenarios where people have to be cautious and careful about how they treat information.

    So we do a lot in terms of the policies. We also, as in the call centre, provide training at different times to different people to suit their needs. So in the call centre that is an initial training as part of their initial training and then through ongoing monitoring, and then following up with that training if we think there is still any deficiencies.

  • You tell us that S was part of the key customer recognition scheme known as Unique and also a member of the Upper Class support team; as such, what level of training had S had?

  • The Unique programme that we have is in relation to our key customers, which are either commercially important to us because they are our frequent fliers or they are VIPs, celebrities, who have specific needs and have made specific requests in the past that we need to make sure we are cognisant of in order to keep their business.

    Anybody who would be involved in dealing with those VIPs or important customers would have an additional day's training before they were be allowed to be involved in that programme. So there is another day's training again which deals specifically with the sorts of situations we find ourselves in in relation to those customers, whether that is because we need to arrange special services for them or whether that is because they have been asked to be kept low profile.

  • Does that training have a data protection element?

  • You tell us at paragraph 25 of your witness statement that S told you that the details had been obtained from the booking system used by Virgin Atlantic for making flight reservations; was that a system to which S needed to have access to perform the job?

  • Over the page, you tell us that it is your opinion that despite all of these steps it is ultimately impossible to guard against an employee breaking the rules and ignoring the policies and providing confidential information; is that right?

  • I think that is right. I mean, no system is perfect and indeed, you know, we, like any other organisation, audit our compliance with the law, with policies and with procedures that we have set out, and we do that in relation to the Data Protection Act on a reasonably regular basis. We probably had an audit a couple of years ago and we will probably have another one during the course of this year, for obvious reasons.

    In the course of those kinds of audits you always find things you can improve and as technology moves on and practices move on you need to amend the things you are doing to make sure you are keeping up and doing the best that you can.

    But in this particular instance, for as long as there is a piece of paper that somebody can write information on and take it out of our building, especially if they are incentivised to do so, I don't believe there is something we could do that could safeguard completely against that.

  • Returning to the question of the investigation which Virgin Atlantic Airways conducted and in particular its scope, was the scope of the investigation confined to the actual allegations made by first of all the Guardian and then the Press Gazette, or did it go wider?

  • In the first instance because we didn't have somebody who was admitting -- in fact they were denying that they had carried out the acts that had been alleged -- we went broader than just looking at that person's particular access to the system and we looked more generally across a team of people to see if we could find any evidence of what was being alleged, and we carried that sort of broader investigation through to the end.

    There was another allegation which I have talked about in my witness statement that was made by a member of the press which ultimately hasn't been substantiated. We followed that up, and so to that extent it was a broader investigation.

  • Just to bring matters up to date, since you produced your witness statement, is it right that you have written to Big Pictures?

  • We have, and I think we have done various chasing letters, asking them for an explanation of what has happened.

  • Have you had a response?

  • Thank you. Those were all my questions.

  • Ms Brady, thank you very much indeed. You will appreciate that the reason why this story and this evidence is of value is because it demonstrates what somebody unconnected with the press or press organisations can do and does do when confronted with type of problem.

  • Thank you very much indeed.

  • I am happy for the witness to return to her seat.

  • (The witness withdrew from the witness box)

  • Could I invite you, sir, to treat as read the statement of Nigel Regan, the CEO of Big Pictures, and also the statement of Josh Halliday, of the Guardian, both of which go to this issue.

  • Could I also invite you to treat as read the statement of John Evans of HMRC.

  • Yes. It is quite important that people should understand what that is. That deals with the question which has been raised several times during the course of the Inquiry about differential Value Added Tax treatment, and demonstrates that such a prospect would not conform with the law. I am talking about European law, not just English law. But it is there.

  • Thank you, sir. That, I think, is all the business for today.

  • Not quite. We visualised that there could be a directions hearing tomorrow in relation to module 4 and I wondered whether that could be brought forward to today so as to avoid everybody coming tomorrow. It can't, because, of course, it involves core participants who will not have been involved in today's proceedings and we have not given notice of it in any event.

    In the circumstances, particularly as I believe the issues that might have been raised would be dealt with quite briefly, I have decided that it is not appropriate to bring everybody here, and what I will arrange to do is to arrange for core participants to receive an email or communication identifying the areas which might have been the subject of discussion so that if anybody wants to make representations they can do so.

    Thank you very much indeed.

  • (The Inquiry adjourned until Monday, 9 July 2012 at 10 o'clock)