One challenge for regulators investigating offences using quasi-judicial enforcement measures is the extent of their search and seizure powers, as well as, the tension between the need to fully investigate a matter, gather all relevant evidence, while safeguarding rights, including the right to privacy. This was a central issue in the Supreme Court decision of CRH v CCPC¹, where the court determined that there were limits to the documents that could properly be seized by the CCPC and that the regulator was not entitled to review an individual’s private documents or those belonging to a separate entity whose documents were also stored on the premises. The Irish courts’ approach in this regard is in marked contrast to the recent decision of the King’s Bench Division of the High Court in England and Wales, which found that the tribunal in the case of the Covid inquiry was entitled to undertake a review of the former Prime Minister's documents for relevance and hand back what was not relevant². This question of who determines relevance is often at issue in regulatory investigations.

A particular challenge for regulators is that computers and documents are not necessarily what they need to seize where documents and emails are stored in the cloud and data is also often held on mobile devices. With the prevalence of working from home and hybrid working, regulators increasingly need to contemplate obtaining warrants for searches of family homes as part of a corporate raid.

In order to identify any relevant documents, how does a regulator establish that it requires access to an entire database to identify relevant documents, or to a person’s mobile phone or family home?

Regulators will always be conscious of the need to establish a sufficient legislative basis for search and retrieval. Part of the government’s ‘Implementation Plan’ for combatting economic crime includes amending legislation to provide for standalone search warrants that will allow any investigating member(s) of An Garda Síochána to require persons subject to arrest warrants to provide the passwords to electronic devices owned or controlled by them.

Aside from the Gardaí, a number of regulators including Revenue, the Central Bank, Data Protection Commissioner, the CCPC, Comreg and the Corporate Enforcement Authority (CEA) and indeed the European Commission, effectively have search and seizure powers. To use the CEA as an example, it has the power to require any person who appears to be able to facilitate access, to provide a password for operating computers on site³. The definition of “computer” includes a personal organiser or any other electronic means of information storage or retrieval and “computer at the place that is being searched” includes any other computer, whether at the place being searched or at any other place that is lawfully accessible by means of that computer. There is a proposal to amend this legislation to allow the CEA to search remote items (data stored in the cloud) from locations other than the physical search site and to extend the definition of "computer" to mobile devices⁴, which suggests that the authorities may not be confident this is covered by the current legislation. It is also proposed to allow the CEA to use phones and devices seized to access cloud based data. In the case of the CEA, any person who obstructs a CEA search is guilty of an offence⁵, so those subject to a raid will have little option but to comply and have any row about proportionality afterwards as we saw in the CRH case.

An ongoing issue with corporate raids is the difficulty in safely segregating legally privileged documents. Again, using the example of the CEA, there is a legislative requirement to maintain the confidentiality of such documents until the question of privilege can be determined⁶. The court has recently used its power to appoint an independent person to examine documents over which privilege had been asserted and prepare a report where a dispute arose in this regard [Delaney -v- FAI], but in the absence of the respondent providing a specific basis of a claim to privilege in respect of each document, the court provided the CEA with access to all of the documents concerned⁷. The Supreme Court in CRH called for regulators to publish privilege and privacy protocols. Some regulators have done so, although the extent to which those protocols will withstand any challenges remains to be seen and will likely be fact dependent in any specific case.

In an environment where many regulators now see enforcement against individuals as a key pillar of their strategy to drive increased compliance, what is clear is that the boundaries between regulators’ powers and individual rights will continue to be tested through the courts.

1. [2018] 1 IR 521
2. Cabinet Office -v- Chair of the UK Covid-19 Inquiry, [2023] EWHC 1702 (Admin)
3. Section 787, Companies Act 2014
4. Public consultation on proposals to enhance the Companies Act 2014
5. Section 789, Companies Act 2014
6. Section 795, Companies Act 014
7. Director of Corporate Enforcement & Anor v FAI & Anor, Unreported, High Court, 21 October 2022