I. Introduction
In February this year, the European Commission finally released its proposal for an EU-wide Directive on Corporate Sustainability Due Diligence (‘the draft directive’).Footnote 1 The draft directive, which follows the 2017 French devoir du vigilance (Duty of Vigilance) and the 2021 German Lieferkettengesetz (Supply Chain Law) as well as a 2020 European Parliament draft law on the same topic,Footnote 2 is in various respects the most ambitious of its kind.Footnote 3 Nonetheless, the move to legalize the concept of human rights and environmental due diligence as derived from the international standards has once again tempted European policy-makers (often in the name of ‘legal certainty’) to amend and limit aspects of the internationally agreed and -established concept, with the ultimate effect of reducing decade-long established responsibilities for companies.
The Commission’s draft directive follows several years of consultation at the EU level with considerable public attention, and is currently under consideration from both the Council of the European Union (representing each European government of the day) and the European Parliament (directly elected European politicians). After these institutions conclude their respective positions they will engage in negotiation of the final text, through a process known as trialogue. This piece contributes to critical commentaryFootnote 4 and focuses on several key elements where advocacy and campaigning efforts are now needed to ensure that the final directive does not risk more harm than good by mandating an ineffective ‘tick-box’ approach based on deviated standards.Footnote 5 Key elements discussed include the value chain scope; the conceptualization of ‘leverage’; the reduction of due diligence to specific measures and the prioritization of contractual codes of conduct and audits; and stakeholder consultation.Footnote 6 Suggestions for improvement are made throughout.
II. Reduced Value Chain Scope
As opposed to including the entire value chain within a risk-based approach, the draft directive limits a company’s due diligence obligation to its own operations; those of its subsidiaries (a ‘controlled undertaking’ in EU law); and the ‘value chain operations carried out by entities with whom the company has an established business relationship’.Footnote 7 The term ‘established business relationship’ originates from French law. However, a definitive definition is still pending, subject to rulings from national courts. The Commission has attempted more clarity by proposing that ‘established’ cover both direct (contractual) and indirect (non-contractual) relationships which are – or are expected to be – ‘lasting’ in view of their intensity or duration, and which do not ‘represent a negligible or merely ancillary part of the chain’.Footnote 8 The recitals (themselves non-binding but which offer interpretative guidance) explain that if a company’s direct relationship is ‘established’, ‘then all linked indirect relationships should also be considered as established’.Footnote 9 Whilst this non-binding elaboration may seem expansive, it is ultimately an approach which shifts attention (and enforcement focus) away from the nature and severity of the risk per se, towards whether a business relationship ought to be considered ‘established’ or not.
How limiting these criteria are would ultimately be a question for national judges and enforcement officials: what level of intensity or duration of time is needed for a relationship to qualify as ‘established’? Others have noted that the qualifications carry the potential to generate perverse incentives for companies.Footnote 10 It is conceivable, if not likely, that after a cost/benefit analysis, companies will restructure their existing ‘established’ sourcing relationships into a myriad of shorter, fewer and less ‘intense’ ones, in order to avoid attracting obligations and liabilities. The feasibility of this tactic would naturally depend on the sector and company.
Excluding ‘negligible or merely ancillary’ entities is also problematic, as business activities ancillary to the main activity can be extremely high-risk and best influenced by leverage exerted from the principal company. For example, the high-risk activities of a private security company hired by a foreign subsidiary have the potential to qualify as ‘ancillary’ to the business of mining gold and could thereby be excluded.
However, what is made clear in the draft directive is that the ‘value chain operations’ of entities with whom the company has an established relationship cover both upstream and downstream activities.Footnote 11 This represents a significant improvement on both the French and the German laws, which limit the flow of due diligence obligations to upstream activities and production processes.
III. Due Diligence Duty Distilled to Specific Measures
The draft directive effectively divides the active due diligence duty into two parts: (1) preventing potential adverse impacts and (2) bringing actual adverse impacts to an end.Footnote 12 Here the dynamic process of due diligence foreseen in the international standards has been distilled to an exhaustive subset of specific actions to be taken by the company ‘where relevant’. They are:
• the implementation of prevention/correction action plans, developed in consultation with stakeholders (at times limited to ‘affected’ stakeholders; at others only ‘where relevant’);
• contractually assured codes of conduct with business partners that are third-party verified (by way of audits or industry schemes) and the provision of necessary support for SME partners to comply with said codes of conduct;
• other necessary investments to prevent or end adverse impacts;
• collaboration with other entities in order to prevent or bring adverse impacts to an end;
• the payment of damages when harm occurs.
The essence of due diligence as a dynamic exercise appears to have been curtailed. In order to encourage innovations in responsible business conduct, such a list ought to be made indicative and not exhaustive in its description of the specific actions a company can take in pursuance of its obligation to prevent, mitigate and bring to an end adverse human rights and environmental impacts.Footnote 13
Within this exhaustive list, the specific actions of developing action plans with stakeholder input and ‘collaboration with other entities’ are nonetheless open-ended and do invite innovative responses to complex scenarios, for instance, by collaborating with and encouraging local governments to develop and enforce protective standards. However, this remains problematic as the company itself is left to determine whether it considers such actions – such as developing a prevention or corrective plan in consultation with stakeholders or collaborating with other entities (using leverage) – as ‘relevant’ to take. Even more concerning is the draft directive’s clear prioritization of the use of contractual codes of conduct and third-party verification (see below); and its apparent deprioritization of collaboration with other entities (‘in particular where no other action is suitable or effective’).Footnote 14
Standard of Care: ‘Appropriate Measures’
Ultimately a company would need to assess which one or combination of the above specific actions to employ in order to meet the draft directive’s standard of an ‘appropriate measure’.Footnote 15 The company’s decision to use a specific (set of) action(s) would be reviewable by authorities and judges, with measures found not to have been ‘appropriate’ leading to administrative sanction and potentially, when harm has occurred, civil liability. Notably, the standard of ‘appropriate measures’ includes a series of factors derived from the UN Guiding Principles (UNGPs), namely: the degree of severity and the likelihood of the adverse impact; the need to ensure prioritization of action; and the company’s influence over the particular business relationship.Footnote 16 Therefore, the prioritization of action according to the severity of risk as well as the degree of leverage the company had at that specific point in time will be considered when assessing the liability of a company in lieu of the ‘appropriateness’ of measures taken.
Re-Prioritizing Leverage
The standard appears static and considers a company’s existing influence over a business relationship, rather than its ability to influence. According to the UNGPs, companies must not only exercise leverage to address adverse impacts, but must also strive to increase their leverage when they lack it, in order to enhance their capacity to address adverse impacts throughout their value chains.Footnote 17 In practice, this could well mean the difference between a company taking no for an answer then disengaging after requesting an indirect supplier, together with a direct supplier, for the former to allow bathroom breaks to its workers; and a company that then feels compelled to increase its leverage by collaborating with yet more buyers, local government, or other actors such as domestic or international human rights agencies.
Re-Prioritizing Stakeholder Consultation
The draft directive provides for proactive stakeholder consultation in three ways, all of which are discretionary for the company (identification of risk; development of preventative and corrective actions plans). It provides for one form of stakeholder engagement which is mandatory (complaints measure).
When identifying risks and adverse impacts, the draft directive provides that a company carry out consultations with potentially affected stakeholders, only when (and how, given the lack of guidance) it deems relevant.Footnote 18 When a company decides to develop a prevention action plan to respond to identified risks, it is obliged to consult with affected stakeholders.Footnote 19 When a company decides to develop a correction plan to respond to adverse impacts, it is again up to the company to decide whether it is relevant to consult stakeholders (not directly affected).Footnote 20
Once again, the company’s assessment of whether to proactively consult or not in all of these circumstances is reviewable against the standard of ‘appropriate measures’, which the company is in each case obliged to take.Footnote 21 In the case of risk-identification, if a company did not identify a risk and had not consulted potentially affected stakeholders, then a judge or regulator would need to assess whether having not consulted potentially affected stakeholders, the company had still taken ‘appropriate measures’ to identify the risks to said stakeholders. It is exceptionally difficult to think of a scenario where that would indeed be the case. However, through its formulation the draft directive generates such uncertainty, apparently calling into question the international standards regarding the efficacy of stakeholder consultation in identifying risks to people and planet (and despite what certain businesses have also declared regarding its efficacyFootnote 22). This unnecessary uncertainty is regrettable and, moreover, apparently unbeneficial to companies who require clearly defined rules on what their obligations under due diligence laws actually are. The failure of the draft directive to set a clear obligation for stakeholder consultation will be costly.
The lack of a standardized stakeholder consultation obligation will inevitably lead to an unacceptably slow uptake of the practice by companiesFootnote 23; many of whom are, judging by certain input to the debateFootnote 24, highly likely to firstly and routinely decide it to be ‘irrelevant’; and then, when risks are not identified and preventative and corrective measures fail, devotedly argue their case that non-consultation was nevertheless ‘appropriate’. This will lead to the diversion and waste of precious time, effort and resources, away from the essential goal of the legislation to effectively identify, prevent, mitigate and bring to an end/minimize adverse human rights and environmental impacts. Legal certainty and effectiveness require a clear and mandatory duty to proactively consult stakeholders when identifying and preventing risk and responding to adverse impacts.
Notwithstanding this significant flaw, the draft directive makes it compulsory that companies listen when stakeholders address them, and have their due diligence obligations triggered by ‘well-founded’ complaints. Similar to the German Lieferkettengesetz, the company obligation to establish a complaints procedure comes with an obligation to address any adverse risk or impact arising from a ‘well-founded’ stakeholder complaint.Footnote 25 (However, whereas the German law allows for complaints concerning any point in the supply chain to trigger the due diligence duty, it is unclear whether the draft directive limits this to ‘established business relationships’.)Footnote 26 For complaints, stakeholders are defined as representatives and civil society organizations ‘active in areas related to the value chain concerned’.
Whilst this effectively allows for a form of ongoing stakeholder engagement – it is not a consultation and appears to rest on various implicit and misguided assumptions. First, that it is the primary duty of stakeholders to identify risks and adverse impacts caused in the company’s value chain for the company. It is not. Under international standards it is the company that is responsible for identifying its adverse impacts and those in its value chain, and to undertake proactive stakeholder consultation as an effective means to that end. Second, that civil society groups retain the means and the capacity to effectively monitor companies’ global value chains and bring the multitude of adverse impacts to the attention of the multitude of companies covered. They do not. It is companies – for-profit entities – who retain the means and resources to properly identify the risks and adverse impacts created along their own value chains, inter alia by proactively consulting stakeholders in an ongoing manner. The notable costs associated with the identification of risk cannot be outsourced to the non-profit sector, as it would be far from ‘appropriate’.
Deprioritizing Contracts and Audits
The primacy afforded to codes of conduct, contract-cascading and third-party verification thereof, by audit companies or industry initiativesFootnote 27 is established by turning contract-cascading into a civil liability defence for harms occurring in the value chain, where such a reliance is deemed reasonable. Footnote 28 Putting codes of conduct into contracts with non-direct suppliers and then having them externally verified by private companies is also questionably promoted,Footnote 29 as a means of engaging with non-direct business partners that the company has little to do with.Footnote 30
To make matters worse, there is ample evidence that these – prioritized – actions are proven failures.Footnote 31 One case concerns the death of 259 workers by fire in a Karachi garment factory. In this case, the German purchasing firm – KiK – had a code of conduct in its contract with the Karachi supplier factory; which itself had been audited as compliant with an industry initiative standard (SA8000) by an Italian auditing company – RINA Services – just weeks before the 2012 fire.Footnote 32 What the company KiK did not do was ensure that its own purchasing practices were not contributing to the conditions that led to the fire, a common systemic feature of the textile and other sectors. The draft directive does not oblige companies to ensure they are not contributing to harm through their own purchasing practices, explicitly ignoring the European Parliament’s legislative report which does.Footnote 33 What KiK also did not do was consult directly with workers’ representatives and NGOs to help it identify and mitigate the risks at the factory.
IV. Conclusion
The above-mentioned deviations from international standards, in particular concerning value chain scope; the duty diligence duty; and proactive stakeholder consultation, have all already attracted widespread concern from international organizationsFootnote 34 and independent government bodiesFootnote 35 as well as condemnation from a growing number of civil society organizations.Footnote 36 In order to correct these flaws (and other important ones beyond the scope of this article) advocates and campaigners, together with their partners and allies, will need to continue to clearly – and loudly – elaborate the real world impacts of these deviations for European policy-makers over the course of the coming legislative process. Alignment with international standards ought to be taken as a means to argue for enhanced human rights protection, and not as an end in itself.Footnote 37 Rather than simply citing deviation from international standards as the justifying basis for legislative amendment, advocates and campaigners will do well to continue to develop, uncover and apply real world examples which clearly illustrate the pitfalls of the current draft directive in practice; what is needed to fix it, and why that is important.
Acknowledgments
The author would like to acknowledge and thank colleagues for their ideas and input.
Conflicts of interest
The European Coalition for Corporate Justice is actively promoting strong corporate accountability and human rights due diligence legislation across Europe.
