News

Confidentiality of third parties in regulatory decisions: Know your rights

By Adam Rooney

Regulatory investigations are by their nature invasive.

It is not just the immediate subject of the investigation who can be affected. Often, the investigation can draw in third parties who, ultimately, are judged to have done no wrong. No decision as to their innocence, or lack of guilt, is ever published, however. Instead, the third parties may be vulnerable to the inference that they have simply got away with it: “no smoke without fire”. That inference can be reinforced when the actual decision, even though it does not name the third party in terms, hints strongly at their involvement. Recent decisions have helped to highlight the problem, in the context of both financial services and competition investigations.

Statutory rights to confidentiality under FSMA: decisions by the FCA

The Financial Conduct Authority (FCA) continues to grapple with the impact of s 393 of the Financial Services and Markets Act 2000 (FSMA) on publicity and reporting of decisions following an investigation.

Sections 393(1), (3) and (4) of FSMA confer statutory rights on a third party who is identified in a warning or decision notice which is prejudicial to him or her to be given prior sight of the notice, and to have the opportunity to make representations in relation to it. This can cause delay and sometimes even affect settlements, so the FCA has attempted to circumvent the need to notify and consult with third parties by attempting (albeit unsuccessfully) to anonymise its notices.

Christian Bittar v FCA

On November 10, 2015, the Tax and Chancery Chamber of the Upper Tribunal dealt a blow to the FCA in its judgment concerning the case of Christian Bittar (reported at [2015] UKUT 602 (TCC)). Bittar was the former head of the money markets derivatives desk at Deutsche Bank. On April 23, 2015, the FCA issued a final notice fining the bank £226.8 million for its part in the Libor/Euribor scandal.

The decision made reference to a “Manager B”, and the Upper Tribunal was asked to decide whether Bittar was a person “identified” in the notice, the FCA having already conceded that it was prejudicial to him. The Upper Tribunal concluded: “… there is no doubt that when reading the Final Notice the relevant reader would conclude that Manager B was Mr Bittar …”.

The Upper Tribunal reached its decision by applying the construction put on s 393 of FSMA by the Court of Appeal in Financial Conduct Authority v Macris [2015] EWCA Civ 490. That case concerned a notice issued against JPMorgan, Achilles Macris’ former employer, for failings leading to $6.2 billion losses in 2012 as a result of the “London Whale” trades. The Court of Appeal held that whether or not a person was “identified” in a notice was a question of fact, to be assessed objectively. In her leading judgment in Macris, Gloster LJ had said that the question should be approached in two stages:

• First, can the third party be “identified” by statements made in the notice alone? Inference is not enough for these purposes.
• Secondly, can the third party be “identified” by reference to external material which objectively would have been known to a reader of the notice at the time it was issued?

The relevant “readers” for these purposes were “persons acquainted with the third party, or who operate in his area of the financial services industry, and therefore would have the requisite specialist knowledge of the relevant circumstances … “. Since the FCA had conceded that the purpose of s 393 was to ensure that it treated the reputation of third parties fairly, Gloster LJ stated: “It is unrealistic to disregard what is already known to the market over and above the information stated in the notice.”

Applying that judgment in Bittar, the Upper Tribunal also confirmed that:

• The crux of the matter is what relevant readers would reasonably know and conclude, not whether it is logically possible to deduce the person’s identity from publicly available material.
• The test is applied by reference to a hypothetical person rather than an actual acquaintance or market participant whose evidence is adduced.
• The knowledge of the hypothetical person should be based on information in the public domain, not that which could be obtained after extensive investigation.
• The burden of proof is on the individual to demonstrate that he or she is in fact “identified”.

Christopher Ashton v FCA

More recently, in the case of Christopher Ashton (reported at [2016] UKUT 0005 (TCC)), the Upper Tribunal applied an identical analysis, but concluded that Ashton had not been identified in the notices. The case involved notices issued against UBS and Barclays relating to misconduct in the FX market. Ashton was the former global head of G10 Voice Spot FX at Barclays in London for part of the period when the misconduct was found to have occurred.

The FCA had attempted to anonymise the notices by referring to “firms”, not “traders”, but, in having quoted evidence of conversations on internet chat rooms, the notices clearly contained a “key or pointer” to separate individuals who had participated. Ashton nevertheless failed at the second stage, because there were too many uncertainties as to the identity of the participants, such that relevant readers would not necessarily conclude that they included Ashton.

On November 3, 2015 (after the Bittar hearing but before the Upper Tribunal gave its judgment), the Supreme Court gave permission to the FCA to appeal the Macris decision. It remains to be seen whether the Supreme Court will uphold the wider interpretation of the s 393 rights, or perhaps comment on the gloss added in Bittar, but there does appear to be a shift toward ensuring that the confidentiality of third parties is not only respected but, to an extent, maximised.

Confidentiality of third parties in antitrust decisions

That is also true in the competition sphere. In Air Canada and others v Emerald Supplies Ltd and others [2015] EWCA Civ 1024, the Court of Appeal recently reaffirmed the rights to confidentiality of non-addressees of a European Commission decision fining British Airways and others for an illegal cartel fixing prices in the air freight sector. The commission (as is often the case) had only released a redacted version of its decision, pending its own review of the document to remove any thirdparty or confidential references.

The claimants (all shippers of air freight) sought disclosure of an unredacted copy of the decision from British Airways, to whom it had been addressed, before the commission had been allowed to complete this task. This would potentially have given the claimants access to prejudicial statements concerning the third-party non-addressees.

The judge at first instance ordered disclosure to a limited “confidential ring” comprising the claimants and their advisors, but the Court of Appeal held he was wrong to do so. The commission reached a similar view regarding “confidentiality rings” in its opinion of October 29, 2015, issued to the English High Court in a different case involving Sainsbury’s and MasterCard.

In its judgment the Court of Appeal reaffirmed the general principle of EU law that no decision should contain any formal finding or even any allusion to the liability of any person unless they had enjoyed all the usual guarantees to defend themselves. This derives from the presumption of innocence, enshrined in Art 48 of the Charter of Fundamental Rights of the European Union.

In Pergan Hilfsstoffe für industrielle Prozesse GmbH v Commission [2007] ECR II-4225, the General Court annulled a commission decision rejecting an application to remove references to a non-addressee and their conduct from a decision concerning the organic peroxides cartel. As a non-addressee, the applicant had had no standing to challenge the references, and it was wrong for the statements to remain part of the decision when they had not been contested or when there was no opportunity for them to be challenged. This reasoning applied equally to any third party who had no means to question a decision, by appeal or judicial review. Under EU law, which guarantees the confidentiality of third parties, the claimants in the English action would not (without some other good reason) have been able to obtain any unredacted decision. Accordingly, they should not be permitted to do so in national proceedings either.

What next?

These decisions are to be welcomed. Central to understanding them both is the ability of the third party, or lack of it, to defend itself — by making representations or otherwise —against a potentially prejudicial decision before it is issued, made public or becomes binding. What is less desirable, however, is the fact that these third parties have been unable to enforce their rights to anonymity without proceedings. They are therefore required to enter a public forum to air grievances which were intended to be treated confidentially, and which ought to have remained confidential. This is counter-intuitive.

Equally, and despite the existence of statutory rights to protect those prejudiced by identification in a regulator’s decision, there is no similar protection for those who are not identified in a decision but who are tainted by association, simply because they are part of a category of persons to whom the decision appears to allude.

What is really required, in all cases, is a sea-change in the conduct of regulatory bodies charged with investigations. In drafting their decisions, they must give effect not only to the letter of statutory or fundamental rights, but also to the spirit and principles which underlie them. This should be done irrespective of whether the third party is an entity or an individual. Although this may cause tensions with the regulators’ other concerns for transparency and expediency, without change we will continue to see regulators penalised in costs or damages through private law actions, when their primary focus should be elsewhere.

Those who might be affected by decisions can take certain steps to improve their position:

• Refer to statutory rights or confidentiality generally at an early stage. In some cases, this might be as early as the first contact from a regulator inviting participation in an investigation, whether by providing documents or answering questions.
• Mark information which is confidential as such. Regulators are unlikely to make that assessment for those who might potentially be affected, or in their favour.
• Follow up regularly. Once information has been given, those potentially affected will need to know when the regulator is drafting or issuing its decision, and must then take action pre-emptively.

This article was originally published in Thomson Reuters and can be found here.