One aspect of compliance that rarely gets mentioned is public law compliance. Public bodies, just like commercial businesses, must act lawfully. Whilst companies are governed by their corporate constitutions, public bodies are governed by the legislation that forms them (or, to the extent they are the legislature, the constitution). For almost all company decisions, the decision-maker is governed by a simple requirement, that they have to act in the best interests of the company. For public law decision-makers however, there are often broader goals and interests to take into account. As regulation gets more complicated and enforcement action more frequent, it is worth thinking about those requirements and what you might do about it if you are on the wrong end of a decision by a public body.
In a world where a whole host of regulators can potentially require you to cooperate with an investigation, submit to interviews, conduct dawn raids and apply sanctions on individuals and businesses, it is important to understand the rules by which regulators must play. Ensuring things are done "by-the-book" not only ensures a regulator works in the manner intended in a way which strikes the right balance of fairness between the various interests at play, but can also avoid businesses wasting time and money responding to inappropriate requests.
Importantly, the law around administrative decision-making focuses on the administrative process rather than the end result. In fact, to the extent the "wrongness" of an end-result is challengeable by way of judicial review, this is on the basis of a decision's "wrongness" being evidence of a fundamentally flawed process. On the reverse of this, the case law contains rafts of challenges to decisions where bodies got to what may well be subjectively the right answer but did so in an inappropriate way.
One of the oldest tropes in movies is the street cop who's "not afraid to bend the rules to get results." For the same reason that the courts would reject a confession beaten out of a criminal suspect; the courts will also allow challenges where a financial services regulator has overstepped the mark.
Whilst administrative law recognises a whole host of requirements and grounds for challenging a regulator's decision, in this article I'd like to briefly address three core issues which get raised repeatedly: decision makers acting outside their powers, acting for an improper purpose and failing to follow proper procedure.
One key aspect of this is that regulators (and other public bodies) have to act within the powers given to them by the legislature. A regulator cannot use powers it doesn't have. If a statute establishes the types of sanction available to a regulator, it cannot easily create new sanctions outside those categories. A regulator also cannot exceed its powers in the lead-up to a decision; it cannot for example require the offering up of documents without a statutory power to do so.
Similarly where a regulator has been granted a discretion they are expected to use it in certain ways. Specifically, they should use their powers for a proper purpose and take into account only relevant considerations. If a power is used for an improper purpose or a regulator takes into account irrelevant considerations (or fails to take into account relevant considerations) their decision would be open to challenge. By way of example, in one well known case a local authority banned stag hunting because it involved unnecessary cruelty. The ban was successfully challenged on the basis that, regardless of the strength of the Councillors' personal views on the issue, the question that had to be considered was whether or not the ban would be for the benefit, improvement or development of the area. An argument could perhaps have been made that as a majority of the population found it unacceptable, a ban on stag hunting would be for the benefit of the area. However as this was not considered the decision was flawed.
Among the other bases for challenging a regulator's decision is a failure to follow a proper procedure. What constitutes a proper procedure for making a decision is the sum of centuries of jurisprudence, but also among the core principles are a number of really rather obvious points. At its simplest, if the law sets down certain steps before a decision can be made, those steps need to be followed. Slightly more amorphous is the requirement to provide a fair hearing – but what is fair, exactly? For the same reason the Merseyside derby isn't refereed by someone wearing a Liverpool shirt, hearings should avoid not only actual bias but the appearance of bias. Similarly, fairness often involves proper notice, and an opportunity to speak and be represented.
What does all this mean practically for those working in business who must comply with the requirements set by a regulator and/or are faced with the prospect of regulatory enforcement. I would suggest it is vital for all businesses operating in the regulated space to understand not only how the law applies to them but also how it applies to their regulator. For example what inspection rights does a regulator have? Can they request you submit documents within a specified timeframe? Do they have the right to conduct dawn raids. Having that level of detail allows you to plan and prepare for just such situations. Knowing you may have to deliver up a file on 30 days notice or respond to a request within a fortnight, creates a need for a very different level of preparedness than a need to be able to provide something on demand.
Similarly, an understanding of the proper process for making an administrative decision may allow a business to challenge or steer a decision-making process which may otherwise create adverse results. In our experience, it is relatively rare for public decision-makers to actively choose to follow an improper process or take into account an irrelevant consideration. Far more common is a situation where someone promoted for their specific expertise (for example anti-money laundering process or data protection requirements) without training on the principles of administrative law. As a result they may then make what to them seems an entirely reasonable decision but which is in fact deeply flawed.
Challenging such a decision through the courts can be tremendously costly. By understanding all aspects of the regulatory environment you are operating in it is often possible to address procedural failings early by way of correspondence. Where the failing is of the kind discussed to date, a simple letter flagging the issue in advance of a decision being finalised may be enough to cause the decision-maker to take legal advice and then change their process (and perhaps with it their ultimate decision).
However, this cannot be done without that initial understanding of the regulatory framework. Bad decisions may go unchallenged in the public law sector simply because no-one affected realised the decision-maker had obligations of the kind discussed. By understanding a regulator's powers, one gives oneself the power to say "no" where these are exceeded. By understanding what constitutes a proper procedure one can challenge impropriety where it arises.
Requiring proper regulatory decision-making isn't about avoiding liability; it's about ensuring the sanctity of the broader system and we should all be willing to stand-up and ask local, national and international regulators to do things properly.
This article first appeared in Compliance Matters, 28 March 2019.
