Am I correct in thinking past incidences don't count as the data is question is only from one PC, the incident when your friend was court. Unless they have proof about past discretions can they do anything about them? Surely it is only this incident, in which you did not take the data offsite.
By the sounds of things he admitted to taking data off site

should have just said i delete the data before going home, then when a manager asks for a recovery you say sorry cant do it i have no backup because you have refused to supply me with equipment
