Supervision Practice in the Face of Emerging Health Risks: How Market Dynamics are Forcing Enforcement Officials to Stretch their Mandate

The modern health care landscape is increasingly hard to capture in regulation and difficult to control by supervision agencies since, due to technological innovation and societal developments, new products and new health risks often emerge that extant regulation does not cover adequately. To counteract potentially harmful conduct, supervision agencies may frequently apply pressure on regulatees through regulatory conversations or negative publicity, even if their conduct may be legal. In this paper we provide context for such interventions beyond the law, outline the broad range of such interventions and discuss their efficacy and legitimacy. We recommend that relevant stakeholders engage in a dialogue that may result in institutional guidelines for supervision agencies on informal supervision practices and interventions beyond the law.


Introduction
Popular beauty vlogger Monica Geuze filmed how she received lip filler injections to obtain fuller lips at Doctors at Soap in Amsterdam, a private clinic for cosmetic surgery. This resulted in an influx of new customers at Doctors at Soap. These were mostly young women, some underage, who wanted to have lips just like Monica. 1 For offline media, the Dutch Mediawet (media code) requires such product placement to be disclosed in a way that clarifies to the consumer which content is commercial in nature. This requirement does not apply to online media. Therefore, the Dutch media regulator Commissariaat voor de Media (CvdM), which supervises compliance with the Mediawet, lacks a legal basis to intervene. This makes young consumers vulnerable to online surreptitious advertising.
Melatonin is a hormone prescribed to treat sleeping disorders. There is only one licensed melatonin based drug admitted to the market in the Netherlands. Due to large demand, many unregistered food supplements containing a lower dosage of melatonin are sold at pharmacies, drugstores and supermarkets. However, currently the benefits and side effects of melatonin have not been researched sufficiently. This leads to concerns about the efficacy and risks of using melatonin, especially amongst children. The Dutch Health Care Inspectorate (IGJ) 2 and the Dutch Food and Product Safety Regulator 3 therefore maintain that melatonin products with a dosage of 0.3 mg or higher may not be sold without prescription, because consumers are not aware of the risks. However, industry bodies 4 maintain that melatonin is a food supplement and not a health care drug and have successfully sued against IGJ's intended enforcement actions towards melatonin supplement sales. 5 These two Dutch examples of conflicting interests are not unique to the Netherlands. In modern economies, consumers demand new, health related products and services that are available by the click of a mouse in our digitalised, globalised society. Often though, these products and services pose health risks, even though the extent of these risks is uncertain. In the case of melatonin, health risks are suspected but there is yet insufficient scientific evidence to substantiate those risks and impose regulation. In the case of cosmetic surgery on minors that does not serve a medical purpose, the risk is also societal in nature. Vlog publicity contributes to a beauty standard that may lead to a negative self-image and normalise subsequent cosmetic surgery. Surreptitious advertising for such surgery can be regarded as harmful. The targeted youth may insufficiently distinguish between the opinion of the vlogger and commercial suasion.
Increasingly the question emerges what the role of regulation, supervision and enforcement is and should be. Regulation increasingly falls short to mitigate the risks posed by the globalised and digitalised health market. Current research indeed indicates that four in ten inspectors in the Netherlands regularly or often observe harmful conduct that is not illegal because regulation is lagging behind. 6 If such risks become evident, additional regulation tends to be the standard solution. In the given example it is argued that needless cosmetic surgery should be banned. A European directive is being drafted to counteract surreptitious advertising online in addition to the current surreptitious advertising regime. However, although regulation might be considered the logical route from a rule of law perspective, its substantial drawbacks are wellknown. Introducing new regulations has a substantial lead time during which the risks endure.
At the same time, the public demands protection from regulatory agencies and holds them accountable for harm, even when regulation is lacking. As Almond points out, 7 the public belief in the legitimacy of the UK's Health and Safety Executive is for instance influenced more by awareness of the risks it controls than by knowledge of its legal mandate. This presents supervision agencies with the dilemma that they strive to serve the public interests and ' create public value', 8 but lack the legal basis to act outside of given regulatory limitations.
This evokes the question whether current supervision practice holds possibilities to counteract risks that are as of yet unregulated. The main topic of this paper is how supervision agencies respond to emerging health risks if new products or services are developed or new health risks of current products become evident but they lack the explicit regulatory mandate to take enforcement action. What options do they have to mitigate these risks and prevent societal harm? How and to what extent do they take advantage of these options, and is that effective and legitimate? Section 2 discusses our methodology. Section 3 indicates the modern societal context that supervision agencies find themselves in, the expectations they face and accepted theories and standpoints on emerging unregulated risks. Section 4 provides an overview of the options supervision agencies have to deal with such risks within and without the limits of current regulations. This section elaborates on informal supervision methods to counteract harmful but legal conduct ('interventions beyond the law'), 9 but precedes this with a discussion of intervention options for harmful conduct that arguably is covered by regulations because we argue that interventions beyond the law should be understood against this ' default' background. Section 5 analyses the risks of such interventions beyond the law in terms of legality and legitimacy of supervision, especially in case of supervision of emerging risks. We end this paper with conclusions and recommendations for supervision agencies in responding to legal but harmful conduct.

Methodology
The primary empirical foundation for this study consists of 23 interviews with senior representatives of supervision agencies in the Netherlands, 10 primarily health and product safety related. The interviews addressed the question how regulators deal with new health and product-related safety risks that are yet unregulated. Respondents were selected that were expected to have both strategic oversight and relevant hands-on experience. These were typically regulatory officials with relevant middle and higher management positions, occasionally (on their request) seconded by a colleague with additional expertise. There was no non-response. The interviews all took place in the respondents' workplace and lasted between 43 and 82 minutes. Given the limited knowledge available about regulators' actual considerations in the face of harmful but legal corporate conduct, the interviews were semi-structured and exploratory. They focused on respondents' perceptions and experiences in the context of recent regulatory cases. Also discussed were the range of methods and options for action employed, outcomes, policy perspectives, the impact of the particular industry and regulatory context, as well as other factors respondents deemed relevant. The interviews were recorded and transcribed, and transcripts were analysed using standard coding software, consecutively employing a provisional and structural coding approach. 11 Respondents were informed about the scholarly objective and subject matter of the interview before they consented to participate. We guaranteed confidential treatment and publication anonymity of all personal and interview data. Interviewees are not quoted in this paper. To provide examples, we supplemented our data with public sources of relevant health sector cases that we reference in this paper.
A second empirical source for this paper is an explorative document analysis of cases and reports issued by Dutch regulators active in the health domain: the health inspectorate IGJ; the care authority NZa and, in relation to advertisements and product placement, the media regulator CvdM. This analysis was conducted on the basis of a web search on the websites of these three agencies for cases that fitted within the scope of the research over the years 2015-2019.
The interview data, case examples and public sources relate primarily to the Dutch context. However, although details will vary between jurisdictions, the supporting scholarly literature that we reference in this paper indicates that the phenomenon of potentially harmful but legal conduct in the health domain and the associated regulatory responses is salient in any jurisdiction.

Context: public supervision in the 21 st century
As a result of globalisation, digitalisation and scientific and technological innovation, societal risks that emerge become more and more complex. There is often no objective knowledge available on the effects of new technologies and products. 12 Much of current product and safety regulation dates back to the 1970s and lags behind these technological and societal innovations. At the same time there is often little political will or consensus to issue new regulation, given the current epoch in which political preferences for deregulation and liberalisation often prevail, political fragmentation and discord is rife and risk regulation tends to be regarded as paternalistic. New regulation often needs to be aligned in a multi-level (e.g. European) context, which slows down regulatory reform even more. And issuing new regulations often requires substantial expertise and consensus on the status of scientific proof for the risks to be regulated, which are often lacking.
Markets have changed as well. Due to technology and innovation, increasingly situations emerge where the law is lagging behind market developments and thus provides insufficient basis to supervise and enforce. Current regulation may be too detailed and may therefore not cover new products or services adequately. Market developments often outpace regulation and jurisprudence. In addition, market and societal developments often take place at the margins of regulation and market participants innovate exploiting the loopholes of the law.
Moreover -and partly as a consequence of globalisation -new, unknown market participants emerge, products -or components thereof -become more difficult to trace, and it is becoming harder to ascertain whether local production quality controls are sufficiently reliable. Where once the health domain was still somewhat transparent because it was dominated by a limited number of major players, in the current markets many small, specialised technology-based companies emerge. These suppliers of health related products and services are much more elusive due to their numbers, diversity and global dispersion. Health is increasingly marketed in products and services with unproven efficacy and necessity that may also pose health risks, such as total body scans and food supplements with unfounded health claims. 13 Market entry of new players with a different profile than traditional suppliers of health products (e.g. beauty vloggers) amplifies this elusiveness due to a blurred distinction between health products and food, consumers seeking a fix for problems previously regarded as simply to be accepted, and the pharmaceutical industry's response to these trends with new products. 14 Compared to the ever increasing pace of technological and scientific developments, regulatory reform is often slow -this has been referred to as the 'tortoise and hare' issue. 15 An additional, inherent issue with regulation is that rules often do not offer the flexibility that is required in a rapidly changing context containing substantial uncertainties, novel risks, and ongoing new scientific insight on risks. Regulating new risks can lead to excessive regulation and block innovation. 16 Principle-based regulation may be relatively flexible, but carries its own set of problematic characteristics. 17 Risk regulations' shortcomings emerge in supervision practice more often and more urgently, but supervision agencies are still expected to prevent societal harm.
Against this backdrop, the Toezien op publieke belangen (Supervising public interests) report by the Wetenschappelijke Raad voor het Regeringsbeleid (Dutch Academic Counsel for Government Policy) argues that the focus of public supervision should be public interests and societal benefits. 18 Supervision should be problem-oriented, risk-based and focused on societal impact. Societal impact means foremost that regulations are complied with, whereby not only the letter of the law but also its spirit is considered relevant. Moreover, in addition to counteracting individual compliance issues, supervision agencies should flag societal developments and initiate public discussions on overarching issues in their domain. In health care, an example of such an issue might be the development of novel, expensive medicine, that may in the long run threaten the affordability of the health care system. 19 Another example might be the widespread prescribing of medication for harmless afflictions that would otherwise pass spontaneously, such as prescribing gastric acid inhibitors to counteract reflux with infants (i.e. regurgitating small quantities of food). 20 Supervision agencies are thus expected to quickly respond to new risks and new knowledge about risks, but often their legal mandate offers insufficient basis for enforcement action to address these risks. A narrow interpretation of the supervision agency's mandate can therefore lead to a legalistic and overly restrained response. 21 Realising societal effect may sometimes require that the supervision agency deals with societal problems that were not foreseen when drafting current regulations, but nevertheless harm the public interests. Online surreptitious advertising for superfluous cosmetic surgery for minors might fall into that category. To address such issues supervision agencies should possibly not only respond after the fact, but also make use of effective preventive methods to influence regulatee conduct. A modern regulator has the capacity to employ a range of intervention options that includes on the one hand promoting voluntary compliance through education, awareness campaigns and compliance assistance and on the other hand formal enforcement to force unwilling regulatees to comply and deter potential perpetrators. 22 An effective supervision agency stimulates regulatees' sense of responsibility 23 and the self-regulatory capacity of the industry (including both market parties and customers) and strengthens the societal force field in which 13  market entities such as industry and consumer organisations operate in order to boost social pressure to act responsibly. Employing such a broad range of intervention options, regulations present supervision agencies with '(…) reference points about which [they] may organize the exercise of discretion (…)' 24 rather than delineating the limits of their scope of activities.
The following section provides a theoretical overview of supervision agencies' intervention options if faced with new risks and illustrates this with examples drawn from Dutch health care regulation. We distinguish regulated and unregulated new risks. In this context 'unregulated' indicates that the conduct producing a risk is currently not covered by the regulations that the agency oversees (so, generally, the agency is not mandated to enforce to mitigate the risk). A risk can therefore be classified as 'unregulated' even though general tort law applies.

Intervention options for new risks arguably covered by regulations
4.1.1. Applying current regulations A supervision agency may conclude that a new product or service is covered by the regulation it oversees and should therefore conform to the same standards as prior products. This was for instance the IGJ's argument in the melatonin case, showing incidentally how this approach may lead to issues. The court ruled in this case that the IGJ was not entitled to apply the Geneesmiddelenwet generically to all melatonin products without having tested them individually for potential harmful characteristics. Currently the IGJ is preparing an enforcement policy to enable enforcement against individual products with a dosage exceeding 0.3 mg. In the meanwhile melatonin remains readily available while, according to the IGJ, consumers are insufficiently aware of the possible side effects.
To realise effective enforcement, cooperation between agencies is of prime importance. In the melatonin case for example the IGJ is drafting enforcement guideline in collaboration with the Dutch Food Safety Authority NVWA. If it comes to medical auxiliary appliances that are often produced and registered abroad, such cooperation should be international in nature. 25 In situations where the specific health regulations are insufficient to enforce against a malpractice the government might also employ other regulations. An example of such a strategy is provided by the Optimel Control case as highlighted by Lelieveldt and Boonen. 26 Dairy producer Campina introduced Optimel Control in 2007 as a functional food supplement that helps to eat less by creating a sensation of saturation. Although the textual claims on the product packaging and the associated website were accurate, the elaborate marketing campaign suggested through a range of visual cues that Optimel Control would lead to weight loss. The textual and visual claims were thus different, and the enormous commercial success of Optimel Control and the consumer responses to the product in the period after the product launch indicate that consumers were adopting the interpretation that matched the suggestions triggered by the visual marketing cues. This exposed a gap in the scope of current regulations on commercial health claims, as these cover textual claims only. Should this scope be expanded to include visuals? Lelieveldt and Boonen argue that this would lead to a 'regulatory nightmare', as the European Food Safety Authority is already faced with a gigantic task in assessing the accuracy of textual health claims and proving the influence of visuals on health related conduct would be unfeasible. They suggest that, instead, supervision agencies might enforce based on unfair trading practice regulations, as these are substantially more intrusive towards misleading claims than commercial health claim regulations. This is because unfair trading practice regulations forbid a misleading ' overall presentation' of a product, even if the presented information is accurate. On basis of these general regulations a misleading health claim may thus be enforced against more effectively than through applying the specific health claim regulations. Clarendon Press (1992). 25 An example here is the cosmetic filler Hyacorp that is discussed in this paper. Hyacorp was produced in Germany. The IGJ received complaints and performed research indicating that Hyacorp has harmful side effects. However, the IGJ cannot independently enforce against a producer located in Germany. The IGJ therefore appealed to the German regulator, which performed its own research and subsequently revoked the CE quality mark and issued a ban on these fillers. Open legal standards such as a general duty of care may also provide a basis to enforce against specific harmful practices. Supervision agencies can of course enforce against transgressions of such a general duty. But supervision agencies can also interpret such a general duty broadly with guidelines and examples that apply to a specific product or service. They can identify best practices in interpreting this general duty that serve as an example for other market participants. The basis for such interpretations is often thematic investigations (e.g. inspections) of compliance levels regarding specific regulations. In such thematic investigations the supervision agency outlines market developments, identifies strengths and weaknesses in the industry and addresses regulatory compliance issues. Such investigations are often the starting point of a dialogue with the industry, in which the supervision agency and the industry jointly interpret field norms, set goals, or prompt self-regulation.
An example in the health industry is the NZa's supervision of health insurance companies' duty of care to ensure legitimate, good quality, timely and accessible health care for their customers. This duty of care was implemented in the context of the introduction of competition in the health care industry in whichbesides a considerable buying power -health insurance companies were also attributed a responsibility for the quality of health care (previously this was solely the medical professional's responsibility). In 2017 the NZa concluded that health insurance companies focused their health care purchasing process too much on price, rather than quality and accessibility. The NZa published a supervision framework that provides additional guidelines for the interpretation of health insurance companies' duty of care. 27 This framework makes it explicit, for instance, that temporary foreseeable scarcity of drugs is not a valid reason for a health insurance company to not comply with its duty of care. Such scarcity can for instance occur through fluctuations on the international market for rare drugs or limited availability of drug components combined with large demand. The framework also indicates more clearly in which cases health insurance companies can claim force majeure if they are not able to guarantee health care continuity.

Informal supervision
Informal supervision can also serve to counteract practices that harm consumers or pose health risks. Informal supervision is comprised of decreasing harmful corporate or individual conduct through informal means instead of formal means such as fines, injunctions and other legal measures. Supervision agencies tend to opt for informal supervision if they expect that this will be sufficiently effective and at the same time less intrusive and time consuming than formal enforcement.
Supervision agencies may for instance employ a values-based approach in which they appeal to the organisation to improve compliance and stress its moral and legal duty to comply with regulations and even beyond. 28 During such a conversation the supervision agency may implicitly or explicitly threaten to apply enforcement measures. In many cases this suffices and the supervision agency does not need to initiate enforcement procedures. Such a conversation can also result in negotiations. 29 For instance, the degree in which the regulatee will adapt its conduct may become subject to discussion, or the pace of this adaptation.
A similar informal supervision instrument is to stimulate self-regulation and co-regulation, bringing together consumer organisations, professional bodies and industry and other stakeholders in industrywide dialogue to set industry standards, codes of conduct, professional codes or guidelines. 30 These types of orchestration and persuasion may also result in companies displaying 'beyond compliance' conduct, 31 by which they intend to prevent more harm than the law requires them to do.
Another informal supervision tool is the use of reputational pressure through either more neutral disclosure of inspection reports and performance information -enabling customers and other stakeholders 27  to make informed choices, or more normative and expressive communication, such as warnings, speeches or press releases addressing risks or even naming and shaming companies. 32 But a more positive approach, such as 'naming and faming' -publicly commending a firm's conduct and thereby rewarding improvements or beyond compliance conduct -may also stimulate responsible conduct.
An example of informal supervision in the health industry is the cosmetic Hyacorp-fillers case. This concerned a range of products produced by a German firm and distributed in the Netherlands by Dutch distributor Dalton Medicare. In September 2012 the Dutch association for cosmetic surgery filed a complaint about these fillers with the IGJ. The complaint indicated several complications with these fillers. The IGJ announced an investigation but such an investigation takes up a lot of time -only in April 2016 did the German supervision agency issue a ban on the sales of these products, which finally removed them from the European market. 33 However, Dalton Medicare already withdrew these fillers from their distribution channels in the Netherlands shortly after discussing the issue with the IGJ and the NVCG, pending the outcome of the investigation. 34 The threat of liability or potential reputational damage may have had a role in this decision.
The informal supervision as described here is aimed at counteracting conduct that is known to be harmful. But informal supervision can also aim to gather knowledge and data on the potential harmfulness of products or services, or at putting an issue on the public agenda. In this manner, to gain a more informed view on particular harmful practices, supervision agencies might encourage industry bodies, corporations or consumers to report examples of such practices. For example, in response to complaints about silicone breast implants, The IGJ commissioned the National Health Institute RIVM 35 to collect complaints from customers. The RIVM approached nearly 1000 women with silicone breast implants about their health complaints. 36 This enabled the IGJ to obtain a clearer picture of the nature, severity and scale of the complaints. This could provide information for supervision purposes or substantiate additional measures such as intensified supervision or further guidelines.

Intervention options for unregulated risks
Asides intervention options for regulated risks, the interviews and document review have provided insight into a number of strategies that regulatory agencies employ when responding to unregulated risks. This section presents the interview findings on the intervention options, their strengths and weaknesses and the challenges they pose, with regard to unregulated risks.

Regulatory advocacy
Supervision agencies can bring novel, unregulated risks to the attention of legislative bodies with the intention of advocating regulatory reform. Supervision has a crucial role in the policy cycle, as supervision agencies' professional hands-on knowledge of policy execution contributes to the quality of regulatory reform. 37 An important instrument in this context is the regulatory reform letter by which supervision agencies can request the legislative bodies to issue additional regulation, enforcement powers and legal intervention options if they find that current regulation is insufficient to intervene if new risks materialise. Market scans, industry mapping and other forms of exploratory research may map the harms done by specific products or services. Such interventions are not immediate supervision interventions, they rather put topics on the public agenda. However, this regulatory advocacy does contribute to a sense of urgency that can make regulatees anticipate on upcoming regulatory reform in their business practices, stimulate self-regulation and encourage corporate social responsibility initiatives.

Interventions beyond the law
Although influencing the regulatory agenda may be effective in the long run, in the short run it does not alleviate the tangible harm that can result from emerging, unregulated risks (we reiterate that in this context 'unregulated' indicates that the relevant conduct is not covered by the regulations that the agency over-sees, even though e.g. tort law may apply). In the face of such harm, supervision agencies at times counteract harmful but legal conduct in their supervision practice without an explicit legal mandate (interventions beyond the law), 38 either because they regard this conduct as '(…) not in spirit of law or they feel more could be done (…)'. 39 Indeed, recent research suggests that only 1% of Dutch inspectors never observes interventions beyond the law. 40 Given the lack of an explicit legal mandate and thereby the lack of formal enforcement powers in the face of harmful but legal conduct, supervision agencies tend to counteract such conduct through informal interventions. To a large extent, the range of interventions supervision agencies apply to counteract harmful but legal conduct is similar to the range of interventions applied to illegal conduct as described above. But the way such interventions play out in practice differs substantially.
First, the fact that, in the context of harmful but legal conduct, supervision agencies normally cannot escalate to formal enforcement measures changes the way informal measures play out. To the extent that the regulatee is aware that its conduct is legal, an implicit or explicit enforcement threat may not be effective (regardless of the problematic morality and legality of issuing such an empty threat).
Second, the fact that in the context of harmful but legal conduct supervision agencies cannot appeal to a legal norm or standard also changes supervision dynamics. Instead, the supervision agency may argue for standards congruous to those contained in regulations 41 or appeal to widely supported societal norms and the social responsibility of the corporation or individual involved. An example of this is IGJ's letter to the industry on data security in the health care sector. 42 Due to outdated software, unprofessional data management by subcontractors or personal negligence of health care employees, leaks of confidential medical patient data regularly occur. 'Increasing technological capabilities offer opportunities to increase quality and safety of health care, but carry risks as well,' according to the IGJ. Health care providers are legally required to report a data leak incident with the Privacy Authority, but there is no obligation to report such an incident with the IGJ. Still the IGJ asks health care providers to report these incidents, appealing to their social responsibility. The IGJ states in its policy brief: (…) Even so the inspection values receiving information from health care providers, as is the case with other incidents within the institution that do not fall directly within the inspection's supervision scope. By informing the inspection, the health care provider enables the inspection to better fulfil her supervision task regarding quality and safety, as an incident involving personal data and the way the health care provider deals with this incident provide insight into the functioning of the quality management system and the institution's transparency.
The effectiveness of an appeal to such extra-legal norms depends, amongst other things, on the authority that the corporation or person involved attaches to these norms. Moreover, whether the harmful conduct is indeed contrary to such extra-legal norms can be subject to interpretation and discussion, perhaps even more than in the context of legal norms.
A supervision agency might also promote self-regulation. 43 The policy department of the relevant ministry tends to have a role in this as well. For instance, with regard to cosmetic surgery performed on minors, general practitioners without specialist training are legally authorised to such interventions. Rather than amending regulations, the minister invited the relevant industry bodies to jointly construct a competency 38 Kasdorp, supra note 9. requirements framework for cosmetic treatment that the IGJ could employ to perform inspections. However, plastic surgeons and cosmetic surgeons failed to reach an agreement on requirements. 44 The issue of surreptitious advertising by vloggers provides a more successful example of invited self-regulation. In this case the CvdM stated in a 'regulatory reform letter ': 45 In the online domain, the Commissariaat observes an increasing independence risk -e.g. with vlogs -if no distinction is made between editorial and commercial content. Especially minors are commercially influenced this way without their knowledge. In light of the crucial interest of protecting consumers (especially minors) against improper commercial influence the Commissariaat shallanticipating the required legal mandate -in 2017 promote that market parties establish self-regulation that should make them follow their own rules to protect minors. To this end, the Commissariaat develops a strategy that will involve speaking with influential vloggers/youtubers/social influencers, owners of multichannel networks and video sharing platforms.
The CvdM first published a research report indicating that 75% of videos by the most influential vloggers mentioned brands without clarity whether this was paid for. This report generated media attention. 46 Then the CvdM spoke with both vloggers and the firms that do business with them to generate rules of conduct. 47 These stakeholders jointly developed the Social Code YouTube. By now several influential vloggers endorse and follow this code. The idea behind this approach is that engaging a number of influential vloggers not only tackles part of the problem directly but may also trigger other vloggers to copy the improved conduct of these trend setters. A press officer of the CvdM states that 'many of the major vloggers attach great value to being seen as authentic. Being upfront about sponsoring supports that goal. We hope that the market becomes aware of the importance of transparency about sponsoring'. 48 Pinpointing and leveraging vloggers' self-interest was arguably the most crucial component in the successful development and execution of the CvdM's Social Code YouTube.
Besides undertaking informal interventions, a supervision agency may also respond to harmful but legal conduct by increasing the frequency and intensity of its supervision activities towards a regulated entity. In health care supervision, this is also referred to as ' enhanced supervision'. 49 Such enhanced supervision can also create pressure to adjust harmful but legal conduct, especially if the supervision agency makes it evident that its enhanced supervision is a response to that harmful conduct. Vice versa, promising a reduction of supervision intensity as a future reward for reducing harmful conduct can also trigger organisations or individuals to commit to such a conduct adjustment. And if the regulated organisation or person entertains an intensive working relationship with the supervision agency -like all major health care institutions do -the desire to maintain a good working relationship can likewise contribute to their willingness to adjust harmful but legal conduct.
It is also conceivable that supervision agencies sanction harmful conduct merely to elicit a court decision. To be seen by the public to intervene, perhaps, or to confront the legislative body with the consequences of its legal mandate limitations. As a court might easily interpret such a punitive approach as an abuse of power, especially if a legal mandate is lacking, this may occur only rarely. But quite often it is not evident beforehand whether harmful conduct or harmful products are legal. Both establishing the relevant facts and interpreting the law can leave a lot of room for a grey area besides the evidently illegal domain -such as the risks concerning melatonin and cosmetic fillers. In this grey area, a supervision agency may still make use of the implicit or explicit threat of enforcement (probably more effectively to the extent that the 'illegal' qualification is more credible). This does, however, raise questions about the legitimacy of such supervision, as discussed in the following section.

Efficacy and legitimacy of interventions beyond the law
In this section we discuss the benefits and risks of interventions beyond the law in terms of efficacy and legitimacy. The potential benefits of interventions beyond the law seem evident. As a response to unregulated risks that pose a societal problem, interventions beyond the law can achieve results relatively quickly. Certainly quicker than awaiting the implementation of new regulations that enable 'regular' interventions based on legal standards. And because interventions beyond the law tend to take the shape of informal supervision -there is after all no legal basis for formal enforcement measures -they also incorporate a benefit of informal supervision: due to the lack of obligatory procedural steps, informal supervision tends to be relatively efficient and flexible. However, if a supervision agency cannot resort to the usual legal enforcement measures if needed, how effective are interventions beyond the law? Responsive regulation theory posits that the efficacy of an informal or cooperative approach depends on the credible threat of escalation to a more formal -usually tougher -approach (talk softly, but carry a big stick). 50 This theory thus predicts that supervision interventions are less effective to the extent that the regulatee is less convinced that these interventions feature a legal basis and is thus less impressed by the threat of a big stick. Take for example the case of a general practitioner who performs cosmetic surgery on minors without specialist expertise. If the IGJ urgently requests this doctor to cease this practice with an appeal to the interest of these minors' health, but the doctor is aware or suspects that the IGJ cannot enforce this request, how effective is this? This issue is aggravated by the opacity that may result from the health domain's increasingly layered accountability and oversight structure. 51 That interventions beyond the law can nevertheless be effective is due to several context factors. First, it is often -certainly in the health sector -not clear what conduct is or is not legally prohibited or required. There can be substantial grey areas. The framework of rules and standards applicable to health care professionals and organisations is so complex and open to interpretation that even health care lawyers can struggle to determine which apply in which case, and where legal requirements end and self-regulation begins. Partially for this reason, regulation texts tend to be consulted mostly if a conflict is already imminent. And most well-meaning health care professionals and organisations prefer to prevent such conflict. In light of their reliance on a good working relationship with the health care supervision agencies, conflict seldomly leads to positive overall results (even if the argument itself is 'won'). Supervision agencies can therefore exploit this grey area by remaining vague about where they think the limits of regulatory requirements lie and leveraging their authority to counteract conduct that they consider harmful through informal supervision -which may well include interventions beyond the law. Especially if the supervision agency is thoroughly convinced that the observed conduct is harmful and therefore feels justified to explore the limits of its mandate. This may involve an explicit balancing of pragmatic considerations (counteracting harmful conduct, preventing societal damage) and legal considerations (legitimacy, rule of law). But sometimes supervision agencies themselves fail to realise where their legal mandate ends and the balance they strike between these conflicting values thus remains essentially random. 52 Second, many professionals and organisations are susceptible to other incentives than the deterrent effect of potential formal legal measures, certainly in the health care industry. Research implies, for instance, that the need to maintain a sound reputation can push organisations to exceed the requirements of regulations, especially if this reputation is crucial from a commercial point of view. 53 The NVWA leverages this reputation effect by issuing unedited publications of its food safety assessments. 54 The NVWA intends to expand this approach to include its assessments of health care sector regulatees, 55 knowing full well that such reputation effects are impactful in the health care sector and are thus attractive leverage to help realise supervisory goals. Supervision agencies can also incentivise professionals to make improvements by positively or negatively comparing their practices to those of their peers, even beyond regulatory requirements.
Besides efficacy, legitimacy is also a crucial driver of interventions beyond the law. Legitimacy here should be understood broadly, as encompassing not just legal validity but also moral justifiability (in accord with shared moral values of society and in pursuit of the public interest) and public approval. 56 In this context '(…) legitimacy refers to the foundation of authority, in the form of public validation, which underpins the actions of state institutions'. 57 It is often defined as '(…) a generalized perception or assumption that the actions of an entity are desirable, proper, or appropriate within some socially constructed system of norms, values, beliefs, and definitions'. 58 Interventions beyond the law indeed often result from societal pressure on the supervision agency to spring into action in light of new risks and thus manage public perception and uphold societal validation of the agency's supervision regime. If serious health risks persist until regulation amendments come into effect, supervision agencies can have a hard time explaining to politicians, media, and the public why they do nothing to mitigate these risks. A 'we are pushing for regulatory reform' defence is not readily accepted, especially if the emergent risks materialise in more sick or wounded people or even fatalities. But interventions beyond the law also result from supervision agencies' autonomous drive to further the societal values for which they were established (safety, fairness, health) and counteract what they consider to be malpractice.
The legitimacy of interventions beyond the law can be problematic. First, if a supervision agency pressures a regulatee to cease conduct that it considers harmful, the regulatee may not have an adequate legal recourse. After all, rather than a legal proceeding, this supervisory interaction might be categorised as an informal negotiation sui generis. The supervision agency's pressure is not based on a legal standard and it is usually not executed through a formal legal decision that entitles the regulatee to file an administrative complaint or appeal to an administrative court in order to obtain clarity on the extent of its obligations. 59 From an ethical perspective such an interaction may be more problematic as the supervision agency exerts more pressure. Factors that impact this degree of pressure include the threatened or implied consequences of unsuccessful negotiations and the supervision agency's 'tone of voice' during this negotiation. Exerting pressure through interventions beyond the law is also more problematic as the regulatee is more dependent on the supervision agency's good will and possibly consent, and non-cooperation is therefore not a realistic option. 60 To many health care organisations, for instance, it is crucial to remain on speaking terms with the IGJ and NZa. In addition, interventions beyond the law also seem more problematic to the extent that the supervision agency is bluffing. That is, to the extent that the supervision agency itself is less convinced that the disputed regulatee conduct can be interpreted as contrary to regulations, but still acts as if it is (or neglects to mention that this conduct is legal). Vice versa, if a supervision agency is candid with the regulatee -stresses that it finds the disputed conduct legal but nevertheless harmful -interventions beyond the law may be less problematic from an ethical perspective.
The norms applied by interventions beyond the law present a second legitimacy issue. If a supervision agency classifies legal conduct as harmful or undesirable, it necessarily applies an extra-legal norm or standard (not defined by regulations). If a supervision agency for example discourages general practitioners to offer cosmetic surgery to minors, it is presumably applying a 'field norm' that it considers to be widely supported in the health sector.
Such an appeal to an extra-legal norm evokes empirical and other practical questions, of course. How widely is this field norm supported? How much support is enough? How does the supervision agency know about this support and where is the proof -or at least plausibility -for this claim? These questions seem more problematic as the extra-legal norm applied is further removed from the relevant legal (regulatory) norms. There is also a risk that the supervision agency is captured by an industry lobby that suggests to apply 56 D. Beetham an extra-legal norm consistent with its constituents' interests (e.g. because its constituents comply with this norm regardless, but potential competitors do not).
But the more fundamental rule of law issue is whether the supervision agency is legitimised in principle to apply an extra-legal norm to harmful but legal conduct, as extra-legal norms lack the democratic legitimacy that laws and regulations derive from the institutions and processes that produce them. 61 The issue here is not with supervision agencies using field norms per se. Field norms may provide a tangible reference point to help interpret open-ended regulatory norms and determine whether conduct is contrary to those regulatory norms. It has long been recognised that '[r]ules cannot be written that will always work as their authors would have wanted them to, and decision-makers work in institutional settings which necessarily give them scope for judgement'. 62 And using field norms to guide this judgement may be as valid as other interpretative methods. The potential legitimacy issue is rather with applying such field norms -or other extra-legal norms, such as extra-legal regulatory frameworks or normative opinions broadly accepted in society -in the absence of 'underlying' regulatory norms, or in cases where the scope of regulatory norms is unclear.
The issue is also not with legitimacy in the narrow sense of legal validity, necessarily. From a legal standpoint one might argue that the representative of a supervision agency does not require an explicit legal mandate to engage a regulatee in an informal conversation on harmful conduct and field norms, any more than he/she needs a mandate to talk about the weather. Rule of law principles do not limit a supervision agency's conduct to that extent. As long as it does not force or unduly pressures the regulatee through legal or other means to curb its conduct to comply with these field norms, it is not obvious how it would be unlawful for this agency to engage in such a conversation.
From a broader legitimacy perspective a supervision agency can nevertheless be expected to exercise caution and restraint. After all, even during such an informal conversation it is still implicitly wielding the authority vested in it by the regulatory framework. It is not 'just someone' having a conversation. In the absence of the more self-evident legitimacy of enforcing regulations, a supervision agency may therefore be expected to ensure that its informal interventions to counteract harmful but legal conduct are morally justified (in accord with shared moral values of society) 63 and that they meet public approval. 64 And, given the difficulty in establishing what is morally justified and what meets public approval, this broader legitimacy remains inherently debatable.
The potential legitimacy deficit of supervision agencies' applying an extra-legal norm might be somewhat less problematic if this norm is about to be implemented in regulations in the foreseeable future. The CvdM for instance legitimised its intervention towards vloggers' surreptitious advertising, first, by extending present norms for other information channels to online media given that the European legislator strives for equal treatment of various media in its future regulation. The CvdM then argued that it is due to obtain a supervision mandate that includes vloggers within a couple of years and pointed towards the importance of protecting minors against improper commercial influence. As its press officer explained, '[t]he regulation is still to be approved by the European Parliament, it will take a few years before it can be implemented. The Commissariaat therefore hopes that vloggers will now commit to self-regulation, anticipating this regulation'. 65 The transparency the CvdM applied while executing its approach -e.g. by publishing this approach in its yearly regulatory reform letter -arguably contributes to its legitimacy. This counteracts the impression that the CvdM exerts influence behind closed doors to evade accountability.
Supervision agencies mitigate such legitimacy risks primarily by engaging stakeholders in a dialogue about their interventions beyond the law and about the underlying extra-legal norms and expectations. The apparent intention is to compensate the lack of formal democratic legitimacy by increasing support and legitimacy in the eyes of these stakeholders. Supervision agencies realise that stakeholders who are involved in the process of an agency's policy decision making perceive those decisions, as well as the agency itself, as more legitimate than they would otherwise do. 66 And in the health domain, supervision agencies that strive to maintain legitimacy need to take into account a range of stakeholders. 67 A dialogue on the agency's policy can involve political stakeholders, such as the ministry politically accountable for the supervision agency. It can also involve the affected section of the regulated industry, other experts and obviously the organisations or individuals that the supervision agency targets with its interventions beyond the law. In this way, the need for stakeholder legitimacy makes supervision agencies more dependent on support -or at the least passive acceptance -from regulatees and other stakeholders.
Interventions beyond the law thus complicate and potentially obscure the working relationship between supervision agencies and regulatees. A relationship in which both parties partially depend on each other for their legitimacy, and at the same time leverage the other party's dependency to shape the accepted interpretation of what is proper compliance conduct. For instance, in a media interview 68 the Inspector General of the NVWA appealed to meat factories' corporate social responsibility to reduce harmful but legal conduct within and outside their organisation (some meat factories for example mix rotten meat with fresh meat so that the mixed product remains within the legal food safety measures and the rotten meat can thus legally be sold to consumers). But this also implies that meat factories that respond to such an appeal and pursue improvements within their own organisation or within their industry will expect cooperation and flexibility from the NVWA. And they also can leverage the media to corner the supervision agency by attacking its reputation.

Conclusion and recommendations
The modern health and health care landscape is changing at an accelerating pace. This landscape is increasingly hard to capture in static regulation and difficult to control by supervision agencies. In such a context supervision agencies may feel compelled to expand their activities beyond enforcement of regulations and promoting legal compliance to flagging new risks and stimulating businesses to go beyond compliance, and indeed they do. They coordinate with their administrative, political, and industry stakeholders to better control such risks. 69 And they also apply informal pressure on regulatees to counteract risky or harmful practices, even if these practices are legal.
As innovation and globalisation become more dominant drivers in health industries, the importance of supervision agencies' policy function will also increase. This calls for thorough public reflection and dialogue on supervision agencies' role in the health domain, which may result in renewed institutional guidelines for supervision agencies. The purpose of such dialogue and resulting guidelines is to ensure that supervision -as an integral part of the policy, regulation, supervision, and enforcement cycle -fulfils an effective and legitimate role in safeguarding public health. The remainder of this section substantiates these recommendations.
Reflection on the role of supervision agencies should include consideration for informal supervision and interventions beyond the law. Besides straightforward enforcement, supervision agencies employ a rich arsenal of alternative interventions that are at times surprisingly efficient and effective. This arsenal ranges from applying present regulation to newly emerging risks, applying generic legal provisions or regulations from other domains (possibly in cooperation with other agencies), broad interpretations of open norms, to disseminating best practices and various forms of informal dialogue with regulated professionals and organisations, as well as other informal methods to counteract harmful conduct. Examples of such supervision methods are promoting self-regulation, 'intensified supervision', 'standard-affirming conversations', leveraging positive or negative publicity and bluffing that enforcement is imminent. At times it is unclear whether the conduct that is the focus of informal supervision is illegal; at times is clear that this conduct may be risky or harmful, but is strictly speaking not illegal (interventions beyond the law). The need for such interventions can vary per industry segment. For instance, in a rapidly evolving domain that often features newly emerging business models, this need can be more intense. In a domain where open regulatory norms cover much of the potential harmful conduct and harmful but legal conduct is therefore scarce, this need might be mostly absent.
If a supervision agency contemplates interventions beyond the law it needs to strike a balance between efficacy and legitimacy and consider involving political, industry and societal stakeholders. How this balance is struck depends on the aggregation level. 67 Almond, supra note 7, for e.g. points out that the UK Health and Safety Executive interacts with three distinct groups in its legitimacy dialogue: regulatory stakeholders, the general public and actors within government. 68 R. de Lange, 'De rotte appels bestaan alleen omdat anderen iets van  At a micro level, between supervision agency and regulatee, the supervision agency would be wise to explicitly state that the (potentially) harmful conduct is nevertheless legal. This not only enhances legitimacy (fair process), it may -depending on the regulatee's compliance motivation -also be more effective than obscuring the legal status of the harmful conduct. After all, the perception of fair process can increase a regulatee's willingness to comply. At this micro level the supervision agency can also involve regulatees, interested third parties and unaffected experts if it considers whether health threatening conduct is (potentially) harmful to the extent that this may justify pressing the regulatee to adjust his/her conduct. Involving interested third parties may also help legitimise interventions beyond the law, for example if they voice health complaints.
At the higher aggregation level between a supervision agency and (a section of) the regulated health industry, transparency may imply that the agency accounts for its policy on informal supervision and interventions beyond the law in its annual report, including abstracts -anonymised if needed -of specific examples of such interventions and their impact on public health. It may imply that the supervision agency frequently engages health industry, experts and the relevant political authority in a dialogue on this topic. This may create understanding and possibly support for its policy. The accountability implied in such a dialogue can also lead to a meaningful delineation of the supervision agency's interventions beyond the law. And it may prompt the health industry itself to address the problems otherwise targeted by these interventions.
At the institutional level, striking a balance between efficacy and legitimacy can require constructing a policy framework that accounts for interventions beyond the law (and thus provides a degree of political legitimacy) without stifling such interventions needlessly. It may be constructed as a guideline limited in scope to health care supervision agencies or to the domain they oversee, but it may also be implemented as a directive applicable to government supervision more generally.
The policy framework would instruct supervision agencies, first, to devise and adopt appropriate safeguards for regulatees against undue pressure from interventions beyond the law. These safeguards need to be adaptive, meaning that they should counterbalance a power differential between supervision agencies and regulatees and that their rigour should depend on the interventions' intrusiveness. An informal conversation without consequences might not need any safeguards; placing an organisation under an ' enhanced supervision' regime might require advance permission from the supervision agency's board of directors; leveraging adverse publicity, or threatening to revoke a licence or strip an executive from his or her position might require prior consultation with an independent committee or institution.
Second, a policy framework would instruct supervision agencies to ensure transparency about their policies on informal supervision methods and interventions beyond the law and specify how they are held accountable. This transparency should cover both the aforementioned safeguards and the way agencies apply these interventions in practice (e.g. in their annual report, as suggested above). Accountability would, at a minimum, imply that supervision agencies regularly report on their policies in this regard to the politically responsible ministry. But the ministry might also be mandated to perform or commission an independent assessment of the efficacy and legitimacy of a supervision agency's informal supervision practices and interventions beyond the law.
To ensure legitimacy -and thus promote long-term efficacy 70 -supervision agencies would be wise not to limit these transparency and accountability efforts to a merely instrumental level. This means they should not only explain how their informal supervision methods and interventions beyond the law are responsive to the needs of their stakeholders and serves their particular interests at that particular time. In his seminal paper on managing legitimacy Suchman 71 points towards the moral dimension of an agency's legitimacy, which requires reflection on what is the right thing to do for society as a whole. Supervision agencies may thus be more profoundly legitimised if we frame a discussion on their methods -including the pros and cons of interventions beyond the law -as an ongoing dialogue on how these agencies might best create public value 72 to serve this higher societal goal.