COVID-19: Investigations and White Collar Crime: What to expect as the pandemic unfolds
Executive Summary
The COVID-19 pandemic is presenting significant challenges for everyone, including regulators and An Garda Síochána.
For ongoing regulatory investigations and enquiries, our experience so far is that a 'business as usual' approach is being adopted by most of the main regulators. While routine and unannounced visits have become more challenging, taking health and safety issues into account, we expect that regulators will continue to exercise these powers where and when required.
In the short-term, An Garda Síochána are likely to focus on macro issues such as public health, security and the economy. However, in time we expect that some divisions such as the Garda National Cyber Crime Bureau and the Garda National Economic Crime Bureau will become active and busy dealing with the continued fallout of the Covid-19 pandemic.
While many businesses are settling into the 'new' norm of remote working arrangements and/or are facing tough business decisions, it should not be presumed that regulators will accept this as a reason for delays in responding to regulatory investigations or enquiries.
What will happen to ongoing investigations and enquiries?
It is early days of course, but as noted above our experience so far is that it is 'business-as-usual' for many of the main regulators as regards ongoing investigations and enquiries. For example, the Central Bank of Ireland (CBI) has specifically stated that it 'expects regulated firms to have appropriate contingency plans in place to be able to deal with major operational events' (Statement: COVID-19 Virus dated 4 March 2020) (for more information on this statement, please see our dedicated insight article here). Businesses should not expect extensions on deadlines or a pause on investigations or enquiries as a matter of course.
In saying that, certain sectors will be significantly more impacted by the pandemic than others and should look to work with the regulator to find a workable solution to manage business demands alongside dealing with any ongoing investigation or enquiries.
What to expect in the short term?
A large number of regulators, with specific enforcement divisions, have well-established remote working policies. However, for others, flexible working represents a learning curve over the coming weeks and months. It is a fluid situation, the impact of which will ultimately depend on the extent of the pandemic which is not yet known. However, we expect to see an increased focus on digital / electronic engagements and solutions.
Since the crisis began, many law enforcements agencies and regulators have issued statements and press releases regarding operational matters as well as issues relevant to their statutory remit. In particular, some regulators have honed in on specific issues which may become the subject of future regulatory investigations and/or enquires:
- In a statement issued by the Health and Safety Authority (the HSA), it reminded employers that they are statutorily required 'to ensure, so far as is reasonably practicable, that an appropriate assessment of the risk for COVID-19 in their workplace is carried out. Suitable control measures should be identified and implemented to mitigate the risk of COVID-19 infection'. In order to be effective, control measures should be communicated to all employees (COVID 19 – Advice for Employers dated 11 March 2020).
- The Competition and Consumer Protection Commission (the CCPC) issued a statement focused on the influx of 'new' hand sanitiser products and surgical masks onto the Irish market. It noted that it is 'actively monitoring compliance with current consumer protection law requirements, including commercial practices which are misleading to consumers and will take appropriate action to protect consumers' (COVID-19 – CCPC Reminds Businesses that Consumer Protection Law Requirements Remain dated 20 March 2020).
- The Data Protection Commissioner (the DPC) has acknowledged in a statement that the impact of Covid-19 may result in unavoidable delays in responding to data subject access requests (DSAR). Nevertheless, the DPC states that the timelines are mandated by the GDPR and cannot be changed. Where a DSAR cannot be responded to on time, it recommends that 'the reasons for not complying with the timelines should be documented by the organisation and clearly communicated to the affected individuals'. Should a subsequent complaint be made to the DPC, it has stated that 'the facts of each case including any organisation specific extenuating circumstances will be fully taken into account' (Covid 19 and Subject Access Requests dated 25 March 2020).
For a composite table of these statements and press releases as of 30 March 2020, please click here.
Should we expect a change in the way in which regulators exercise their powers?
Regulators typically have a range of statutory powers, to compel documents and information, available to them. Many of these powers can be invoked without the need for court approval or physical service. By way of example, under the Taxes Consolidation Act, 1997, an authorised Officer of the Revenue Commissioners can compel the disclosure of books, documents and information without the need to obtain a court order. This request can be made by way of letter delivered by ordinary post.
Certain compellable powers, most obviously search warrants and/or production orders, can only be exercised upon the obtaining of a court order. Given that all court jurisdictions have significantly scaled back operations, it seems likely that there could be some disruption to this aspect of the regulators' powers. It is not yet clear, for example, whether search warrants/production orders will be considered as urgent applications by the relevant court, although we expect this will be the case (for more information on the Operation of the Courts please see our dedicated insight which is located here).
Routine and unannounced visits from regulators
We expect to see a decrease in routine visits owing to practical health and safety issues resulting from such actions. HPRA was the first regulator to announce the '[cancellation of] routine compliance inspections at the sites of regulated companies until Sunday 29 March 2020' (Covid-19 – Cancellation of all upcoming face-to-face meetings at the HPRA offices dated 12 March 2020). We expect this period to be extended and for more regulators to follow suit in the coming weeks (particularly in light of the restrictive measures announced by the Government on 24 and 28 March 2020). For more routine 'supervisory' engagements, it is likely that these will be rearranged in due course.
While unannounced visits will become more challenging, taking health and safety issues into account, we expect that regulators will continue to exercise these powers where and when required. In particular, we expect that there could be an increased focus on the healthcare and pharmaceutical/medical products sectors which could lead to an increase in non-routine measures or supervisory interactions at this time.
For further information please contact Katie O'Connor, Partner, Joe Kelly, Partner, Ciarán Ó Conluain, Partner and Mairead O'Brien Solicitor, or members of the A&L Goodbody White Collar Crime or Litigation & Dispute Resolution teams.
Date published: 30 March 2020