FAQ: information requests from regulators (update June 2022)

In December 2021, the Coalition Agreement ‘Looking out for each other, looking forward to the future’ was published, showing that the Rutte IV government is making extra resources available to regulatory authorities, such as the Dutch Data Protection Authority, the National Ombudsman and the inspectorates (e.g. the Labour Inspectorate, the Housing, Spatial Planning and the Environment Inspectorate and the environmental services), to allow them to perform their tasks properly. One of the powers of a regulator to properly perform these regulatory tasks is the information request (also referred to as an information demand).

This blog will focus on the various ways in which regulatory authorities request information in practice and the possibilities for companies to respond to such requests. A different approach may be required depending on whether the request from the regulator is written or oral and whether the request is made formally or informally. Below we will first describe the legal framework for information requests by regulators, after which we will discuss the practical tools available to companies. Partly on the basis of this framework, information requests can be assessed for legitimacy.

Legal framework for the request for information

Who may make a request for information?

Article 5:11 of the General Administrative Law Act (”GALA”) stipulates who qualifies as a regulator. Briefly summarised, regulators are the natural persons who, pursuant to a statutory provision, are charged with the supervision of certain statutory rules. For instance, certain officials of the Dutch Labour Inspectorate have been appointed as regulators for (among other things) compliance with the Foreign Nationals Act, the Minimum Wage and Minimum Holiday Allowance Act and the Working Conditions Act (see: Designation Regulations for Regulatory Officials and Officials with Specific Implementation Tasks under SZW Legislation).

What can a regulator ask?

• Article 5:16 of the GALA grants a regulator the power to request information from anyone. This power is limited to facts: employees are thus not required to give their opinion.
• Article 5:17 of the GALA gives regulators the power to request inspection of business information or documents and to make copies thereof. Consider, for example:
  • recordings of telephone conversations (ECLI:NL:CBB:2021:883);
  • bank statements (ECLI:NL:CBB:2015:288); and
  • GPS data (ECLI:NL:RVS:2015:3950).

Duty to cooperate

If a regulator makes an information request, the person to whom the request is addressed must, in principle, provide that information. This obligation is contained in the duty to cooperate as laid down in article 5:20(1) of the GALA. The duty of cooperation obliges the person concerned to, in principle, cooperate in the exercise of regulatory powers by regulators. In principle, because the duty of cooperation does not apply to:

• persons to whom a duty of confidentiality applies (article 5:20(2) of the GALA); and
• informal requests. The duty to cooperate only applies to “requests” within the meaning of the GALA (see also below).

The duty to cooperate of article 5:20(1) of the GALA does not only apply to the supervised company, but to everyone. In concrete terms, this means that the regulatory authority may request information from a third party if the supervised party itself does not have that information (ABRvS 23 December 2015, ECLI:NL:RVS:2015:3950, par. 5.2). In short: if a company (whether or not under a third party) is in possession of the requested data or documents, this company must provide this information in view of its duty to cooperate.

Enforcement of duty to cooperate

Previously, administrative bodies could only enforce non-compliance with the duty of cooperation if this was explicitly provided for in the relevant special legislation. If the special law did not provide a basis for administrative enforcement, non-compliance could only be enforced through criminal law (failure to comply with an official order, article 184 of the Penal Code).

With the legislative change per 1 July 2021, article 5:20(3) of the GALA introduced a general basis for the administrative authority to enforce the duty to cooperate by imposing an administrative enforcement order (and therefore also an order subject to a penalty, see article 5:32 of the GALA) (Bulletin of Acts and Decrees 2021, 135, p. 2). As a result, enforcement of the duty of cooperate through administrative enforcement order or an order subject to a penalty will no longer find its legal basis in special legislation. However, the GALA does not provide a legal basis for the relevant administrative authorities to enforce the duty of corporation through the imposition of an administrative fine. The legal basis for the imposition of an administrative fine will thus remain laid down in special legislation.

Article 5:20(3) of the GALA thus provides the administrative authority with an instrument to enforce the duty to cooperate, subject to a penalty of an administrative enforcement order or an order subject to a penalty. Article 5:20(4) GALA does stipulate that in case of legal proceedings against the administrative order, the (jurisdictional) rules apply that are also applicable to any legal proceedings against decisions pursuant to the relevant special legislation. If the administrative body enforces the information request by means of an order subject to a penalty, the person to whom the request is directed will forfeit penalty payments if he does not comply with the information request. But when is this the case? In any case, if that person refuses to cooperate. One can speak of a refusal to cooperate if, for instance, the regulatory authority can make it plausible that more information is available than has been provided by the company (CBb 14 September 2021 ECLI:NL:CBB:2021:883). It is therefore important that it is clear to the employees within a company which information a regulator is requesting precisely, and which company information is available to provide. If it ultimately turns out that incomplete or incorrect information has been provided, this may constitute a breach of the duty to cooperate.

Requirements for the request for information

The information request of a regulator must meet certain requirements. We will elaborate on these requirements below.

1.       The request for information must be proportionate

First of all, it is important that a regulator only exercises its powers to the extent that this is reasonably necessary for the fulfilment of its task. Article 5:13 of the GALA obliges a regulator to apply the principle of proportionality when exercising its powers. In view of the proportionality principle, a regulator may only request those documents which relate to the statutory regulation to which the supervision relates (Parliamentary Papers II 1993/94, 23 700, no. 3, p. 141). Furthermore, a regulator must, for example, check whether it can inspect and copy the business records of a company on the premises itself, and only decide to take these records with him for a short period if this is not possible. A regulator will also first have to check whether the person in question is willing to cooperate with a company visit before deploying the police (Kamerstukken II 1993/94, 23 700, no. 3, p. 142).

2.       The regulator must provide sufficient justification for a request

The regulatory authority must justify, i.e. provide the underlying reasons, for its request and also state the applicable legal basis (Parliamentary Papers II 2004/05, 29 708, no. 7, p. 11). As part of the duty to state the underlying reasons, the regulator must state the reasons why the requested information is necessary for the performance of its regulatory duty (ABRvS 28 July 2021, (ECLI:NL:RVS:2021:1674).

3.       The request must be sufficiently concrete

Finally, regulators must be as specific as possible in their requests. A company can of course only properly cooperate with a request for information if it is sufficiently clear what the regulatory authority requires. The Administrative Jurisdiction Division of the Council of State therefore sets high standards for the recognisability of a request (ABRvS 17 February 2016, ECLI:NL:RVS:2016:378).  Taking into account the principle of legal certainty, it must be sufficiently clear to the party concerned what exactly the regulator requires of him.

We can imagine that the relevance of the requested information to the regulator is not always entirely clear. If the request of a regulator is phrased very general (and abstract), the person from whom information is requested can ask the regulator to clarify or specify the request. This is recommended, as to avoid any potential breach of the duty to cooperate.

Approach to information request

As we wrote at the beginning of this blog, the approach to an information request depends on the manner in which the regulator requests the information. The company in question must mainly rely on the wording of the regulator. The chosen wording may show that the request is formal (e.g. because the regulator refers in the request to a statutory power) or informal (e.g. because the regulator “non-committally requests” information).

Not all requests from regulators qualify as a “request” in the sense of article 5:16 or article 5:17 of the GALA. For example, a regulator may make an informal request for certain information during a company visit. Such a request does not easily qualify as a request within the meaning of article 5:16 or 5:17 of the GALA (cf. Acts II 31 January 1996, p. 3664). Neither do written requests always qualify as requests within the meaning of the GALA. For example, the wording of the written request may indicate that it is merely an informal request from the regulator.

As stated above, the duty to cooperate laid down in article 5:20 of the GALA applies only to “requests” within the meaning of the GALA. From a formal point of view, there is no duty to cooperate with informal requests for information. Non-cooperation with a request in the sense of the GALA runs the risk of an administrative enforcement order or even a criminal penalty, whereas this is not the case with an informal request. Furthermore, in case of formal requests, regulators are (in principle) obliged to treat the provided information confidentially. This is not necessarily the case for informal requests.

In case of doubt, companies are therefore generally advised to:

• request the regulator to put his oral request in writing; and
• to ask the regulator which legal power it is or is not using.

For practice

This blog provides guidance on how to deal with (information) requests – whether formal or informal – from regulators:

• If it is not clear whether it is a formal request in the sense of the GALA or an informal information request, or if it is not clear which (legal) power a regulator is using, it is recommended to ask the regulator in question.
• If the person concerned is faced with a very general request for information, it is recommended to ask the regulator to further specify the request.
• If a regulator does not state its reasons for the use of regulatory powers, a justification thereof may be requested.
• If a regulator wants to take records of the premises, it may be suggested that the records be inspected and copied on the premises itself.
• It is important that employees within a company are aware of the available company information, so that they can properly cooperate with an information request and avoid a potential breach of the duty to cooperate.

Of course, these are only general guidelines. The desired course of action in response to a request for information (or demand) will vary on a case-by-case basis.