Towards better enforcement by regulatory agencies in India

by Trishee Goyal and Renuka Sane.

India is on the verge of establishing yet another regulator, the Data Protection Authority (DPA), to implement the provisions under the Personal Data Protection Bill, 2019. As per the Bill, the DPA will regulate anyone who collects data for commercial use with a turnover of more than INR 20 lakh annually. This would cover entities from small time telemarketers to social media behemoths. The scope of its regulated entities will thus be more extensive than any of the regulators previously established in India. The DPA has the power to either suo motu or on a complaint take action against a data fiduciary or a data processor who may be violating the law. It can, inter alia, issue directions, call for information, conduct inquiries, issue orders for injunctive relief, suspend or cancel the registration of businesses.

With such an expansive responsibility, it is important to get the design of the enforcement processes of the DPA right. Failure to follow due process in enforcement would be damaging to the ease of doing business, to the digital and start-up ecosystem and damage India's chances of dominance in these spheres. More importantly, such failures will have adverse consequences on the justice and dignity of the regulated entities.

In a new working paper, Towards better enforcement by regulatory agencies, we study the gaps in enforcement at the Securities Exchange Board of India (SEBI) and the Competition Commission of India (CCI). The gaps pertain to whether processes of natural justice have been adhered to during the conduct of enforcement activities. We reflect on the lessons this might have for the DPA.

In India, there exists a small literature on the problems with the legislative functions (some examples include Burman and Zaveri, 2018; Bhandari and Sane, 2019), and the judicial functions (see Datta et. al., 2019). In this paper we focus on the executive, or the enforcement, functions of a regulator. Our paper also connects to a larger literature across the world on the dilution of accountability at the 'new administrative state'. Administrative agencies are increasingly built with legislative, executive and judicial mandates. Such agencies are expected to draft subordinate legislation, be responsible for licensing and enforcement actions, and also adjudicate on investigations usually carried out by itself. Questions on checks and balances and due process that were reasonably settled in liberal democracies when it came to government functioning are now being debated once again w.r.t regulators.

Why SEBI and CCI?

Before we discuss questions on natural justice, a word on why we chose to study SEBI and CCI. The Justice Srikrishna Committee Report on data protection suggests that the DPA will be modeled along the lines of other Indian regulators such as TRAI, SEBI, CCI etc. Among the regulators discussed in the report, we found that SEBI has been considered the most effective, as far as its enforcement actions are concerned. CCI is relevant as it is a more recently established regulator. A study of CCI comes at an interesting checkpoint in the development of regulatory governance. As the DPA will be modeled on these regulators, it is important to understand how enforcement is currently taking place and whether there is an inherent problem in the structure of enforcement. For example, Roy, Shah, Srikrishna, and Sundaresan (2019) argue that Indian regulators have too often veered into controlling as opposed to regulating, and that enforcement has been selective and weak, and failed to adequately follow the rule of law, especially on due process. State capacity is known to be weak in India, suggesting the need to move beyond existing models of regulatory design.

Three elements of natural justice

Natural justice is a vast area. We focus on the three most basic elements of natural justice - how are notices served, whether parties are allowed to examine material and cross-examine witnesses, and whether there is separation of powers, especially between the investigation and adjudication functions.

Procedural failures at SEBI and CCI

In the case of SEBI, we studied orders of the Securities Appellate Tribunal (SAT) for a six month period (October, 2019 to March, 2020) where we found that 33% of SEBI orders were over-ruled on failure to adhere to principles of natural justice. Of the cases over-ruled, 86% were related to issues of notice and 14% to issues of examination of materials. SEBI fares poorly on separation of powers. With respect to CCI, a survey of appellate orders passed by the Competition Appellate Tribunal and the Supreme Court, pointed to the lack of due process being ingrained in enforcement procedures. However, CCI maintains separation of powers with a far greater degree as compared to SEBI. The design of the enforcement structure also allows for application of mind by the Commission at multiple stages - at the time of formation of prima facie opinion, at the time of issuance of direction for investigation and lastly, at the time of penalty proceedings.

Importance of codification

Why is it that there are such procedural failures? Legislation in India confers certain powers of a civil court to a regulatory agency, and expects that the regulator will comply with the principles of natural justice. There is, however, no guidance on how regulators should comply with these principles (Burman & Krishnan, 2019; Sundaresan, 2018). Common law in India has held the view that principles of natural justice are not considered embodied rules -their application has been made dependent on a variety of factors such as the nature of the tribunal in question, the controversy in question and the facts and circumstances at hand. As a result, the development around principles of natural justice in administrative law has been in an ad hoc manner. There is very little by way of standardised procedures that an administrative body can source from common law.

What would improve these processes? We look at the structure of regulators in other countries - namely the US and the UK. We find that the processes that Indian law just assumes will be followed, are actually codified in laws, regulations and process manuals in these countries. Codification is important as a study of CCI also shows - while the CCI does better in terms of structural separation, issues of due process continue to remain due to scanty guidance available in the Competition Commission of India (General) Regulations, 2009 on other aspects. Codification of processes on legislative powers, such as having more prescriptive rules on the requirements of consultation, have led to better regulation making processes (Burman & Zaveri, 2018).

Lessons for the DPA

We have the following recommendations for the DPA. The objective is to provide adequate guidance to the regulator as it discharges the enforcement function, as well as to the broader community as it continuously evaluates the performance of the regulator on these counts.

1. There should be an inclusion of the procedural rights in the statute itself. These provisions would specify a detailed outline of the show cause notice, the scope of the right of examination of materials, the procedure to be followed in case of ex-parte orders and the timelines of providing representation against each of the processes where such representation can be made.

2. Further, regulations should include the manner in which notice is to be served, the manner of providing opportunity of hearing (written submissions), the form in which materials are to be submitted to the regulated entity under its right of examination of materials etc.

3. The law, regulations, as well as detailed manuals should be available in the public domain.

4. At the very least, there should be a cadre of administrative law officers who would not be engaged in any functions of the regulator except performing the quasi judicial functions. There should be an Administrative Law Member in the Board of the agency whose specific task would be to manage the cadre of administrative law officers. This would lead to the insulation of quasi judicial functions of the regulator from executive, investigation and inspection functions.

Conclusion

The concerns raised by us have begun to get recognised in India. For example, in 2011, the Financial Sector Legislative Reforms Commission (FSLRC) Report laid out a regulatory framework imbibing the principles of natural justice. More recently, in 2019, the Report of the Competition Law Review Committee, reviewed the enforcement processes in the CCI. Similarly, the Sahoo Committee Report set up to examine development and regulation of valuation professionals, while laying out the regulatory design for the said purpose, emphasised the need of principles of separation of powers, reasoned orders, independence and accountability. The follow through on the recommendations, however, has been scarce. We think that a statutory formulation of the administrative law requirements would strengthen the rule of law in enforcement actions.

References

Bhandari, V., and Sane, R. (2019) A Critique of the Aadhaar Legal Framework. 31 NSLIR Rev 1-23.

Burman, A., & Krishnan, K. (2019). Statutory regulatory authorities: Evolution and impact.

Burman, A., & Zaveri, B. (2018). Regulatory responsiveness in India: A normative and empirical framework for assessment William & Mary Policy Review , 9 (2), 1-26.

Datta et. al. (2019), How to Modernise the Working of Courts and Tribunals in India. NIPFP Working paper 258.

Roy, S., Shah, A., Srikrishna, B. N., & Sundaresan, S. (2019). Building state capacity for regulation in India. Devesh Kapur and Madhav Khosla (eds.), Regulation in India: Design, Capacity, Performance, Oxford: Hart Publishing.

Sundaresan, S. (2018). Capacity building is imperative. Column titled Without Contempt in the editions of Business Standard dated August 2, 2018.

The authors are researchers at NIPFP. This paper was produced as part of the Data Governance Network. We thank Somasekhar Sundaresan for useful discussions.