Public Law Essentials 04: Enforcement and regulatory decision-making

Regulation and enforcement are essential government functions. Regulation protects the legitimate interests of the community, businesses, individuals, the environment, and the economy (among others).

The key areas in which regulatory decisions are made broadly relate to either:

• investigation and monitoring for regulatory compliance; or
• decisions to take enforcement action.

This Public Law Essentials discusses enforcement and regulatory decision-making, and in particular addresses:

• the nature and sources of regulatory powers;
• the key decisions that a regulator faces in exercising these powers, including pre-conditions for the power to be enlivened; and
• some of the factors that a decision-maker might take into account.

Regulation in Australia

The source of regulatory powers tends to derive from:

• the legislation which sets out the regulated conduct;
• the Regulatory Powers (Standard Provisions Act) 2014 (Regulatory Powers Act); and/or
• contractual arrangements between government and participants.

Regulatory Powers Act

The Regulatory Powers Act provides a uniform suite of regulatory powers, including monitoring, investigation and enforcement powers. The Attorney-General's Department is the Agency responsible for the Regulatory Powers Act. The purpose of the Regulatory Powers Act as stated by the Attorney-General's Department is to provide "an accepted baseline of powers required for an effective monitoring, investigation or enforcement regulatory regime, whilst providing adequate safeguards and protecting important common law privileges."

For the powers contained within the Regulatory Powers Act to be available to a regulator, the legislation which sets out the regulated conduct for which the regulator is responsible will "trigger" the operation of the Regulatory Powers Act. See for example the Biosecurity Act 2015, which triggered Parts 2 to 7 of the Regulatory Powers Act.

Some Acts may also modify the operation of the Regulatory Powers Act to suit the regulatory regime by, for example, excluding the operation of certain provisions within the Regulatory Powers Act, or prescribing additional powers or limitations on powers.

An example of such a modification is contained at section 92-2 of the Aged Care Legislation Amendment (New Commissioner Functions) Act 2019 which relevantly provides that:

(3) Sections 21, 22 and 33 of the *Regulatory Powers Act are taken to apply as if:

(a) a reference to “24 hours” in sections 21 and 22 of that Act were a reference to “48 hours”; and

(b) a reference to a “24-hour period” in sections 21 and 22 of that Act were a reference to a “48-hour period”.

The current regulatory landscape

Recent and highly publicised commissions of inquiry and reviews by insight bodies (see for example: Royal Commission into Aged Care Quality and Safety and the Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry to name a few) have put the role of Government regulators firmly in the spotlight and have highlighted some of the challenges associated with monitoring and enforcing compliance with government programs.

The findings of the Hayne Royal Commission into the Banking, Superannuation and Financial Services Industry demonstrate the damage, both to the regulators' reputation and to the regulated industry, that may follow from ineffective regulation. Commissioner Hayne said:

"too often, financial services entities that broke the law were not properly held to account. Misconduct will be deterred only if entities believe that misconduct will be detected, denounced and justly punished. Misconduct, especially misconduct that yields profit, is not deterred by requiring those who are found to have done wrong to do no more than pay compensation. And wrongdoing is not denounced by issuing a media release.

The Australian community expects, and is entitled to expect, that if an entity breaks the law and causes damage to customers, it will compensate those affected customers. But the community also expects that financial services entities that break the law will be held to account."

A number of the findings and recommendations of the Hayne Royal Commission Report highlight the need for regulators to approach their functions with an attitude of:

• applying the regulatory toolkit effectively and to not shy from taking action in appropriate cases;
• greater co-ordination and co-operation between the relevant regulatory bodies;
• streamlining or simplifying the regulatory framework, where possible;
• building in mechanisms of independence into the regulatory framework; and
• ensuring meaningful and proportionate deterrence in regulatory action.

While regulators must be seen to be taking strong action against non-compliance, to ensure that any enforcement action taken is defensible, before acting they need to ensure that they have the evidence and information necessary to act appropriately.

Monitoring and investigation powers

Monitoring and investigation powers are key components of a regulator's toolkit to enable them to take effective action against non-compliance.

Monitoring powers enable regulators to check compliance with provisions of an Act or evaluate the conduct of a person who is participating in a government program.

Investigation powers can be used to gather evidence for the purposes of taking enforcement action (for example: to issue an infringement notice).

These powers are essentially about identifying non-compliance and gathering evidence to enable enforcement action to be taken.

Monitoring and investigation powers available under the Regulatory Powers Act

Examples of the types of monitoring and investigation powers that are available to regulators under the Regulatory Powers Act include (this is a non-exhaustive list):

• the power to enter and search premises (sections 18, 19(a), 48, and 49(a) and (b));
• the power to operate electronic equipment (sections 20 and 50);
• the power to examine or observe prescribed activities (sections 19(b));
• the power to inspect and examine goods (sections 19(c) and s 49(c));
• the power to take records (sections 19(d) and 49(d));
• the power to secure or seize evidence (sections 22 and 52);
• the power to ask questions (sections 24 and 54); and
• the power to inspect and copy documents (sections 19(e) and 52).

These powers tend to be invasive and broad reaching and often provide authorisation to impose upon a person or businesses' civil liberties, which are otherwise protected. For example, entering and searching a private premises is ordinarily protected as constituting a trespass. The Regulatory Powers Act provides a power to overcome that protection for the purposes of monitoring and investigation of non-compliance.

Consequently, the Regulatory Powers Act will often prescribe certain requirements which must be satisfied when exercising a specific power. For example, section 18 of the Regulatory Powers Act provides that:

“(1) An authorised person may enter any premises and exercise the monitoring powers for one or more of the following purposes:

(a) determining whether a provision subject to monitoring under this Part has been, or is being, complied with;

(b) determining whether information subject to monitoring under this Part is correct;

(c) determining a matter subject to monitoring under this Part.

Note: The monitoring powers are set out in sections 19, 20, 21 and 22.

(2) However, an authorised person is not authorised to enter the premises unless:

(a) the occupier of the premises has consented to the entry; or

(b) the entry is made under a monitoring warrant.

Note: If entry to the premises is with the occupier’s consent, the authorised person must leave the premises if the consent ceases to have effect (see section 25).”

The effect of this provision is that an authorised person may only enter a premises either:

• with the consent of the occupier (and only until the occupier revokes that consent); or
• under a warrant.

If entering the premises under a warrant, the authorised person may only do so for the purpose for which the warrant was granted (which is limited to the 3 prescribed circumstances set out in section 32(2), and referred to in section 18(1), of the Regulatory Powers Act).

Other obligations may also attach. For example, authorised officers who are executing a warrant must:

• announce that they are authorised to enter the premises (section 26(a));
• show their identity card to the occupier (section 26(b));
• give any person at the premises an opportunity to allow entry to the premises (section 26(c));
• be in possession of the warrant (section 27);
• make a copy of the warrant available to the occupier (section 28(2)(a)); and
• inform the occupier or other person in writing of the rights and responsibilities (section 28(2)(b)).

Similarly, when exercising investigation powers, limitations on the authorised officer's powers will apply such that the powers can only be exercised when certain conditions are satisfied. For example, an issuing officer may only issue an investigation warrant if they are satisfied, by oath or affirmation, that there are reasonable grounds for suspecting that there is, or may be within the next 72 hours, evidential material on the premises (section 70).

Monitoring and investigation powers derived from the Act which contains the regulated conduct or other sources

Many regulators also have supplementary non-compliance identification and evidence-gathering tools under their own regulatory schemes and legislation. Such tools can be particularly useful for allowing regulators to have visibility of particular types of behaviour relevant to their specific scheme.

Some examples of these types of arrangements may include:

• Formal information sharing arrangements, which will allow the agency or regulator to obtain relevant information from another related agency to assist in its investigations;
• Program fraud indicators which are specific to the program that is being regulated. For example:

• requiring regular re-approval for participation in the program, or building in reporting obligations for ongoing participation in the program. This may facilitate detection of non-compliance so that relevant evidence may be gathered without the need to invoke the Regulatory Powers Act. Examples of such obligations include the mandatory reporting of reportable assaults under the Aged Care Act 1997 or the extensive reporting requirements for education providers under the Higher Education Support Act 2003 and the VET Students Loans Act 2016; or
• withholding the benefit of the program until after participants have demonstrated ongoing compliance and eligibility, or have made legally enforceable declarations of compliance. An example of this approach was the COVID-19 Support Payments which required businesses to make ongoing declarations of eligibility (including current turnover) at various points before the next instalment of payments were made.
• develop key metrics which may indicate participant fraud and trigger further investigation. For example: higher than average claims or claim outcomes, higher than average complaints by users of the participant's services, or deficiencies or inconsistencies in key supporting documentation.

• Sampling arrangements

This monitoring and investigation tool is implemented in circumstances where gathering evidence for the purposes of taking enforcement action can be resource intensive, and where sampling may provide regulators with timely and cost-effective evidence to pursue enforcement action when non-compliance is suspected.

An example of where sampling methodology has been effective is the Professional Services Review process of reviewing claims for Medicare and pharmaceutical benefits by medical professionals. In that program, it has been legislated that the director of PSR will obtain a random sample of a doctor's services for which a Medicare or pharmaceutical benefit has been claimed.

Specifically, section 106K of the Health Insurance Act 1973 (Cth) provides:

"(1) The Committee may, in investigating the provision of services included in a particular class of the referred services, have regard only to a sample of the services included in the class.

(2) If the Committee finds that a person has engaged in inappropriate practice in providing all, or a proportion, of the services included in the sample, then, the person under review is taken, for the purposes of this Part, to have engaged in inappropriate practice in the provision of all, or that proportion, as the case may be, of the services included in the class from which the sample is chosen."

Applying the sampling formula set out in the PSR Act, the Committee may extrapolate from the sampling evidence to make a finding about whether a doctor has engaged in inappropriate practice for the purposes of Medicare or a pharmaceutical benefit claim.

These tools may be formally prescribed in the regulator's legislation, they may be underpinned by a contract or deed of arrangement with participants, or they may involve informal arrangements (for example, evidence sharing arrangements with other agencies). Much like the powers prescribed in the Regulatory Powers Act, before seeking to invoke any of these powers regulators will need to be aware of the sources of their power to take specific monitoring and investigation action and the limitations on those powers to act lawfully.

Enforcement action

It is a common feature of Australian legislation to grant the government coercive powers to ensure compliance with legislative requirements. The Hayne Royal Commission highlighted the importance of Regulators using enforcement powers where appropriate and the consequences where a culture of non-compliance is allowed to develop.

The enforcement powers typically available to government include, but are not limited to:

• the issuing of infringement notices;
• applying for civil penalty orders or injunctions;
• entering into enforceable undertakings.

Enforcement powers are generally a discretionary power that is enlivened when a particular factual circumstance arises.

Source of an enforcement power

Enforcement powers are not available for any contravention of legislation, only where an act authorises enforcement action in relation to particular types of contravention. Since 2014, some acts will trigger enforcement powers through the Regulatory Powers Act which provides standardised best practice provisions for certain enforcement powers.

Before taking enforcement action, decision-makers should make sure that they have considered whether the enforcement action is linked to the alleged contravention. The following considerations are often a useful starting point:

• What are the elements of any section being contravention?
• What evidence do you have in support of each element?
• What enforcement powers are available for the alleged contravention?

What type of enforcement action is most appropriate?

Regulators are often provided with a range of enforcement options when dealing with non-compliance. This can involve a graduated series of enforcement measures to be applied flexibly depending upon the nature of a contravention and the particular circumstances in which it occurred.  Often, regulators refer to this as an enforcement pyramid.

While the enforcement pyramid model remains useful, decision-makers need to be careful not to assume that all cases should follow a bottom up process but consider whether the circumstances (such as the seriousness of any non-compliance) require a response at a higher level of enforcement.

Infringement notices

An infringement notice is a notice issued by a regulator which sets out the particulars of an alleged contravention of an offence or civil penalty provision. The infringement notice will then offer the recipient the option to pay a specified amount as a means of discharging any liability for the contravention, without any admission of liability or guilt.

If the person chooses to not pay the amount, the Agency may choose to bring court proceedings against the person in relation to the alleged contravention.

An infringement notice should be distinguished from other notice provisions which are often required as a step in any enforcement action.

As set out in the Explanatory Memorandum to the Regulatory Powers Act, infringement notices are typically used for low-level offences and where a high volume of uncontested contraventions is likely and will generally be used for strict or absolute liability offences with a clear physical element. The benefit of an infringement notice is that it is low cost for both regulators and wrongdoers to discharge any liability.

An infringement notice is generally not appropriate for complex offence provisions or where there are significant penalties involved. As they are not an admission of liability or guilt, they cannot be used as evidence of a prior record of non-compliance in any subsequent action.

Civil penalty orders

A civil penalty order is a punitive order of the Court authorised by a statute that apply a civil, as opposed to criminal, standard of proof. The orders that can be made will in most cases be a fine, but can include non-financial orders such as licence revocations or banning orders.

The purpose of civil penalties is usually cited as being deterrence rather than punishment for non-compliance. For example the Australian Electoral Commission refers to the purpose of civil penalty provisions under Part XX of the Commonwealth Electoral Act 1918 as being “to deter political participants from breaching the Electoral Act and impose a financial penalty for non-compliance.”

Whether a civil penalty is appropriate in a particular circumstance will require consideration of factors such as:

• the nature and extent of the contravention;
• the nature and extent of any loss or damage suffered because of the contravention;
• the circumstances in which the contravention took place;
• any history of similar offences by the person; and
• whether a monetary order will be effective in changing behaviour or may convey the impression that offences are purchasable commodities or a cost of doing business.

Some of these factors may also be considered by a Court when deciding the amount of any pecuniary penalty. For example, the High Court in Australian Building and Construction Commission v Pattinson [2022] HCA 13 said that the compliance history of an entity is relevant to determining the appropriate civil penalty, finding that although the relevant conduct was not the “worst case” the maximum penalty was justified due to the significant history of non-compliance.

Enforceable undertakings

An enforceable undertaking is an enforceable agreement between a regulator and someone who has contravened an obligation under a relevant act in which the contravener agrees to do or refrain from doing certain things in relation to their future conduct.

Enforceable undertakings are only appropriate where an agency is trying to achieve ongoing compliance by the contravener and where it is possible to monitor any ongoing compliance.

Factors to be considered when deciding whether an enforceable undertaking is an appropriate remedy include:

• is the entity giving the undertaking likely to comply with the undertaking, including considering their compliance history;
• are the conditions of the undertaking proportionate to the contravention and is there a more appropriate enforcement option available;
• is monitoring of the conditions of the undertaking practical and/or does the monitoring impose a high burden on the agency;
• what impact does an enforceable undertaking have on the compliance landscape including what message it sends about non-compliance.

Procedural considerations

Once a decision has been made that a particular enforcement action is appropriate, it is essential that any statutory processes are followed and natural justice considered to ensure that the enforcement action can be effectively taken. Even where an enforcement action would otherwise be appropriate, a procedural flaw can invalidate an enforcement action and frustrate the enforcement process.

Enforcement powers will often specify a process that must be followed for the valid exercise of the enforcement power.

For example, an infringement notice under the Regulatory Powers Act can only be given when certain specified conditions occur, such as: a belief on reasonable grounds that a person has contravened a provision that is subject to an infringement notice, the notice must be given with 12 months of the infringement, and the notice must (in most cases) relate to only a single contravention.

A failure to follow a prescribed statutory process can invalidate an otherwise appropriate exercise of an enforcement power.

As well as complying with any statutory processes, you should also consider whether a particular enforcement action raises any issues of natural justice such as:

• procedural fairness or the right to be heard – have you provided an alleged contravener with notice of the alleged infringement and an opportunity to contradict any factual issues;
• actual or perceived bias – could it be argued that the decision-maker had a preconceived outcome in mind or does the decision-maker have any other personal interest in the outcome; or
• the ‘no evidence’ rule in which a decision-maker based their decision upon logically probative evidence – do you have a well maintained file with evidence in support of each of the elements of the underlying contravention and any factors considered in taking the enforcement action.

The time to address any procedural issues is as soon as they arise as once they are raised in any contested situation they will usually be too late to cure.