Weekend Edition Nº171 by eulawlive

Nº171

JANUARY 27

2024

JOHANNA HOEKSTRA

A CAUTIOUS STEP FORWARD: THE CORPORATE SUSTAINABILITY DUE DILIGENCE DIRECTIVE

Nº171 · JANUARY 27, 2024

Weekend

Edition keep smart

A Cautious Step Forward: The Corporate Sustainability Due Diligence Directive By Johanna Hoekstra 1 Introduction On December 14 2023 the Council of the European Union (‘CEU’) and the European Parliament (‘EP’) reached a provisional agreement on the provisions of the forthcoming Corporate Sustainability Due Diligence Directive (‘CSDDD’2) which was proposed by the European Commission (‘EC’) in February 2022.3 This Long-Read examines the proposal and starts by discussing the background to the legislation, then discusses key points of the proposal and the provisional agreement, before examining the strengths and weaknesses of the CSDDD. This is the first EU wide legislation that requires companies to conduct human rights due diligence (HRDD) which means that ‘companies should take appropriate steps to set up and carry out due diligence measures with respect to their own operations, their subsidiaries, as well as their established direct and indirect business relationships throughout their value chain.’4 Currently only three EU Member States have due diligence legislation: France (2017), Germany (2023), and, only on issues regarding child labour, the Netherlands (2021). HRDD laws can help to establish legal liability for corporate human rights abuses.5 HRDD is promoted by the UN Guiding Principles on Business & Human Rights (‘UNGP’) as a measure to comply with the corporate responsibility to respect human rights.6 The UNGP form the foundation of the normative and legislative framework on business and human rights. Unanimously endorsed by the UN Human Rights Council in 2011 they constitute of three pillars: the state duty to protect human rights, the corporate responsibility to respect human rights, and access to remedies. It is the duty of the state to ensure that legislation is enacted that respects, protects, and fulfils human rights. The CSDDD is an example of how a state contributes to achieving that duty. The UNGP state that companies also have an independent responsibility to respect human rights, regardless of domestic legislation. This is generally interpreted as a negative responsibility to ‘do no harm.’ The framework and requirements under the UNGP have been subject to 1. Dr Johanna Hoekstra is a lecturer in international commercial law at the University of Edinburgh. 2. Council of the European Union, Corporate sustainability due diligence: Council and Parliament strike deal to protect environment and human rights (Press Release) (2023). 3. EU Commission, ‘Proposal for a Directive on Corporate Sustainability Due Diligence and Annex 2022’. 4. Proposed CSDDD Recital (15). 5. See for a critical analysis of the potentials of HRDD for instance: Surya Deva, ‘Mandatory human rights due diligence laws in Europe: A mirage for rightsholders?’ (2023) 36 Leiden Journal of International Law 389. 6. United Nations, Guiding Principles on Business and Human Rights: Implementing the United Nations ‘Protect, Respect, and Remedy’ Framework (2011).

Nº171 · JANUARY 27, 2024

Weekend

Edition keep smart

extensive debate with scholars and NGOs who argue that the UNGP are not strong enough to close the accountability gap for corporate human rights abuses.7 Whilst the UNGP are soft law they have achieved a key normative status and given that they represent the minimum that corporations should do it is important that any legislation is compatible with the UNGP.8

Reaching an agreement on the proposed Directive The proposed Directive requires companies to conduct HRDD and the largest companies should adopt a climate transition plan that ensures their business model and policies are aligned with a global warming limit of 1,5 Celsius. The Directive applies to a number of EU companies as well as some non-EU companies operating in the EU market. Adherence will be observed through an administrative body in each Member State which can order compliance and give administrative fines. The inclusion of a supervisory body is encouraging as it takes the burden of monitoring compliance at least partly away from civil society. Provisions are also made for the future development of due diligence guidelines (Article 13) and model contract clauses (Article 14). The company has civil liability towards victims if it can be proven that failure to comply with the Directive resulted in harm to the victims (Article 22). The inclusion of civil liability gives victims of corporate human rights abuses a key avenue that is independent from public enforcement to access justice. Due diligence is an obligation of means and not an obligation of result and companies should ‘take the appropriate measures which can reasonably be expected to result in prevention or minimisation of the adverse impact under the circumstances of the specific case (Recital 15)’.

It is the duty of the state to ensure that legislation is enacted that respects, protects, and fulfils human rights. The CSDDD is an example of how a state contributes to achieving that duty

The CSDDD does not add any reporting requirements. A non-financial reporting requirement exists since 2019 through the EU Non-Financial Reporting Directive (NFD9) and the 2021 EU Corporate Sustainability Reporting Directive (CRSD10) which adds further requirements to the standards of reporting.

7. Anne Lafarre, ‘The Proposed Corporate Sustainability Due Diligence Directive: Corporate Liability Design for Social Harms’ 34 European Business Law Review (2023) 213,214. 8. The CSDDD refers in recital (5) to existing international standards which include the UNGP. 9. Directive 2014/95/EU of the European Parliament and of the Council of 22 October 2014 amending Directive 2013/34/EU as regards disclosure of non-financial and diversity information by certain large undertakings and groups (OJ L 330, 15.11.2014). 10. Directive (EU) 2022/2464 of the European Parliament and of the Council of 14 December 2022 amending Regulation (EU) No 537/2014, Directive 2004/109/EC, Directive 2006/43/EC and Directive 2013/34/EU, as regards corporate sustainability reporting (OJ L 322, 16.12.2022).

Nº171 · JANUARY 27, 2024

Weekend

Edition keep smart

The company has civil liability towards victims if it can be proven that failure to comply with the Directive resulted in harm to the victims

The EC proposed the Directive would apply to the following companies (Article 2): • Group 1: +/- 9,400 companies - 500+ employees and net €150 million+ turnover worldwide. • Group 2: +/- 3,400 companies in high-impact sectors. - 250+ employees and net €40+ million turnover worldwide. • Non-EU Companies with a net turnover of over €150 million in the EU. The CEU’s position, published in December 2022, proposed to limit the number of companies to EU companies with more than 1,000 employees and € 300m turnover worldwide & non-EU companies with EUR 300m net generated in the EU. 11 Whereas the EP proposed to enlarge the proposal to companies with 250+ employees and €40 million + turnover.12 The final agreement reverts to the EC Proposal. The provisional agreement reached between the EU and the CEU includes the following points:13 - Value chain responsibility includes both upstream and downstream activities. This is the first due diligence legislation that requires companies to take responsibility for some downstream value chain activities such as distribution, transportation, recycling, and landfilling. - The EC should publish a list of non-EU companies that fall under the Directive. - Financial Institutions lobbied extensively to be excluded from the Directive and stated that performing due diligence across their entire value chain would represent an unfair burden and disadvantage the sector significantly compared 11. Council of the European Union, Press Release, ‘Council adopts position on due diligence rules for large companies’ (December 2022). (The full agreement has not yet been released). 12. European Parliament, Amendments (1) adopted by the European Parliament on 1 June 2023 on the proposal for a directive of the European Parliament and of the Council on Corporate Sustainability Due Diligence and amending Directive (EU) 2019/1937. Available here. 13. Council of the European Union, Corporate sustainability due diligence: Council and Parliament strike deal to protect environment and human rights (Press Release) (2023). Available here.

Nº171 · JANUARY 27, 2024

Weekend

Edition keep smart

to financial institutions outside of the EU.14 The agreement mostly excludes the financial sector; downstream due diligence is excluded; upstream due diligence is likely included (for their own operations and suppliers). The exclusion of downstream due diligence will be reviewed in the future. This exclusion limits the usefulness of the CSDDD and makes an exception that is difficult to justify because it creates a divergence between the financial sector and other sectors. Furthermore, whilst in the manufacturing industry upstream value chains are the most vulnerable for human rights abuses, in the financial industry this is true for downstream activities as it is key to understand what activities are financed. This makes the exclusion even harder to justify. - Large companies should adopt and put into effect a climate change transition plan. - Victims of human rights abuses as well as NGOs and trade unions have five years to bring a civil claim. The agreement tries to lower access to justice barriers for claimants through, for instance, limiting cost of procedures. There seems to be substantial scope for courts to interpret the reasonableness of civil liability claims. - Maximum fines of non-adherence are no less than 5% of annual turnover. Individual Member States can enlarge this amount if willing. Non-payment of fines can lead to prosecution.15 - Compliance with CSDDD could likely be a criterion in the selection process for public procurement contracts, concessions, public-private partnerships, and the like. - The EC’s proposal that due diligence should be considered a director’s duty is not part of the agreement. The CEU stated this duty could interfere with the overarching duty of directors to act in the best interest of the company.16 The CEU also eliminated the introduction of variable remuneration for director’s depending on the contribution of the company to sustainability. Over the next months the final agreement will be drafted, endorsed, and formally adopted by the CEU and EP.

Analysis of the Directive and Alignment with the UNGP This is a minimum harmonisation Directive and Member States can enlarge the scope of the Directive by adding further requirements for businesses which is positive, but in practice this is not likely to have a significant impact judging from past experience. With the EU Non-Financial Reporting Directive almost none of the EU Member States took advantage of the possibility to designate an independent body monitoring compliance or enlarge the number of companies that fell under the Directive. National parliaments and governments stated that they worried this would affect their competitiveness if other states did not do the same. 17 It is clear most EU Member States prefer to move forwards cautiously and together. 14. Jurei Yada, Pietro Cesaoro, Why the EU’s Due Diligence Law must include the financial sector (2023) EG3. 15. See here. 16. Council of the European Union, Press Release Council adopts position on due diligence rules for large companies (December 2022). Available here. 17. Olga Martin-Ortega and Johanna Hoekstra, Reporting as a Means to Protect and Promote Human Rights? The EU Non- Financial Reporting Directive (2019) 5 European Law Review 622,636.

Nº171 · JANUARY 27, 2024

Weekend

Edition keep smart

There are several key issues with regards to the CSDDD which include its scope, the strength of stakeholder engagement and the complaint mechanism, including a list of specific human rights in the Directive, naming high-impact sectors in the legislation, and the overall reliance on contractual clauses to manage liability.

This is a minimum harmonisation Directive and Member States can enlarge the scope of the Directive by adding further requirements for businesses

Suggestion is that around 1% of EU companies are directly concerned by the Directive.18 Small and Medium Enterprises (‘SME’) fall outside the scope of the Directive regardless of the sector.19 The EC excludes these because setting up a HRDD system would be too burdensome and expensive for SME.20 If SME are part of the value chain of a company that needs to comply with the Directive, then a contractual clause could require the SME to conduct HRDD. So indirectly more companies will be affected by the Directive than those that fall under its immediate scope. The Directive states that larger companies need to support SMEs in this endeavour but likely leaves it to the large company to determine how this support is given. Given the power disparity that often exists between companies of differing sizes this places SME in a potentially difficult position. The contractual shifting of HRDD requirements to SME can represent an unfair burden on SME as HRDD will be imposed without SME having the space to develop their own HRDD policies.21 The UNGP states that the corporate responsibility to protect applies to all companies (Principle 14). All businesses should have appropriate policies in places which can diverge depending on the sector, location, and size of the company (Principle 15). It is therefore a missed opportunity for the Directive not to establish a more universal duty for businesses to conduct HRDD with different requirements depending on the size and sector.

The proposal uses the term ‘established business partner’ and this includes contractual and non-contractual relations (Recital 20). ‘Negligible or merely ancillary’ relations are excluded from the due diligence obligation. The focus is on whether the relation meets the criteria of established relationship rather than on whether there is a risk to human rights.22 This could lead businesses to abandon more established relations and conclude shorter and one-off contracts for risk management reasons.23 The EC states that the reason for confining due diligence to ‘established business relations’ is that in those relations companies can ‘exercise appropriate leverage’ (Recital 20) but existing leverage should not be considered an appropriate measuring stick as it runs counter to the need to further corporate accountability which requires businesses to improve their control and increase their leverage.24 18. European Commission, Proposal for a Directive of the European Parliament and of the Council on Corporate Sustainability Due Diligence and amending Directive (EU) 2019/1937, COM (2022) 71 Final, p. 14. 19. In their 2021 final position paper the European Parliament suggested including SME in high-risk sectors. 20. European Commission, Proposal for a Directive of the European Parliament and of the Council on Corporate Sustainability Due Diligence and amending Directive (EU) 2019/1937, ibid. 21. Shift, ‘the EU Commission’s Proposal for a Corporate Sustainability Due Diligence Directive Shift’s Analysis’ (2022), p. 9. 22. Christopher Patz, ‘The EU’s Draft Corporate Sustainability Due Diligence Directive: A First Assessment’ (2022) 7 Business & Human Rights Journal 291, 292. 23. Ibid. 24. J Ruggie ‘Protect, Respect and Remedy’ Framework to the UN Human Rights Council, available at, paras 65-72.

Nº171 · JANUARY 27, 2024

Weekend

Edition keep smart

The CSDDD states that corporate directors should consider engaging with stakeholders when conducting due diligence (Article 26) and should engage with affected stakeholders, where relevant, to identify, prevent, and remedy adverse impact (Articles 6-8). Therefore, whilst engagement is encouraged it is not mandatory and it is left to the company to decide when it considers engaging stakeholders relevant. The UNGP require meaningful stakeholder engagement throughout the process (Principle 18 (b)). The term ‘high impact sector’ comes from the OECD Guidelines on Multinational Enterprises.25 There is no alignment between the OECD Guidelines and the CSDDD as for instance the EC excludes the financial sector which the OECD Guidelines include. The CSDDD mentions explicitly: textiles, leather, and related products; agriculture, forestry, fisheries, food products, extraction of minerals, and metals (Article 2). The EP has suggested that other sectors should be added such as social care, healthcare, hospitality, entertainment, tech, and cleaning.26 Naming the high impact sectors in the law itself rather than in additional policies makes it more difficult to change the list further on.27 The Annex to the Directive lists the human rights that should be considered (but notes this list is not exhaustive (Recital 25). This list is likely not the definite list. Human rights in the CSDDD are not completely framed in alignment with the existing international legislation as the language differs in places.28 The provisional agreement adds references to specific international human rights treaties including the International Covenant on Civil and Political Rights, the International Covenant on Economic, Social and Cultural Rights, and the Convention on the Rights of the Child. The International Labour Organisation (ILO)’s core conventions can be added once they are ratified by all EU Member States. Environmental impact covered by the Directive includes: ‘any measurable environmental degradation, such as harmful soil change, water or air pollution, harmful emissions or excessive water consumption or other impacts on natural resources.29’

It is a missed opportunity for the Directive not to establish a more universal duty for businesses to conduct HRDD with different requirements depending on the size and sector

25. OECD Guidelines for Multinational Enterprises (2011 Edition) and OECD Sectorial Guidance. 26. European Parliament Resolution of 10 March 2021 with Recommendations to the Commission on Corporate Due Diligence and Corporate Accountability (2020/2129). 27. Claire Methven O’Brien & Olga Martin Ortega, Commission Proposal on Corporate Sustainability Due Diligence (2022) European Union, p. 20. 28. DHRI Report, The Danish Institute for Human Rights, Legislating for Impact: Analysis of the Proposed EU Corporate Sustainability Directive (2022) 13. 29. Part I (18), Annex to the Proposal for a Directive of the European Parliament and of the Council on Corporate Sustainability Due Diligence and amending Directive (EU) 2019/1937. Available here.

Nº171 · JANUARY 27, 2024

Weekend

Edition keep smart

Human rights are indivisible and interdependent and therefore cherry picking among rights, no matter how extensive, is not the right approach to frame the legislation

There is a question on whether individual rights should be listed in the CSDD or whether it would be better to refer solely to existing human rights obligations in general . Human rights are indivisible and interdependent and therefore cherry picking among rights, no matter how extensive, is not the right approach to frame the legislation. The commentary to Principle 12 of the UNGP states that ‘business enterprises can impact virtually the entire spectrum of internationally recognised human rights’ and therefore listing which human rights are covered by the Directive (even if nonexhaustive) could run counter to the UNGP. HRDD should be driven by the actual risks rather than by a pre-set list.30 Companies should identify any adverse human rights risks (including potential risks) arising from their operations, those of their subsidiaries, and direct and indirect business partners (Articles 4-11). Violation of human rights is not the terminology of the UNGP which uses the term adverse impact. The UNGP only use the word violation twice and both in relation to the state violating international law rather than in relation to the activities of the corporation. The CSDDD explains adverse effect as a violation of human rights (Recital 25). It is unclear whether this language could be interpreted by courts as a higher threshold which could be a concern. The UNGP require human rights policy to be approved by the highest level of the organisation (Principle 16 (a) and require that this policy should rely on human rights expertise (Principle 18 (b). The CSDDD is silent on these requirements and having omitted the HRDDD as a Director’s Duty in the final proposal seems to shift further away from the central role of directors.

Businesses should prevent, mitigate, and remedy impact. They also need to communicate their findings, monitor developments after the policy implementation (at least annually) and set up a complaint mechanism (recital 42/Article 9). The UNGP (Principle 29) require an operational level grievance mechanism to remediate any adverse human rights effects to which the company contributes. There is no real discussion of remedies with regards to the complaint mechanism in the CSDD although Article 8 (a) suggests that financial compensation can be required. The term remedy under the CSDDD is interpreted in a narrower fashion than under the UNGP which go further than financial compensation.31

30.Claire Methven O’Brien & Olga Martin Ortega, Commission Proposal on Corporate Sustainability Due Diligence (2022) European Union, p. 18. 31. UNGP Principle 25: ‘Remedy may include apologies, restitution, rehabilitation, financial or non-financial compensation and punitive sanctions (whether criminal or administrative, such as fines), as well as the prevention of harm through, for example, injunctions or guarantees of non-repetition.’

Nº171 · JANUARY 27, 2024

Weekend

Edition keep smart

Companies can avoid civil liability through use of contracting clauses, corporate codes of conducts, and monitoring adherence to these (Article 22). If the companies have secured contractual assurances of compliance the burden of proof in civil liability cases switches to the claimant to show the assurances were inadequate (Article 22). Extensive use of contracting clauses, auditing schemes, and corporate codes of conducts contributes to HRDD as a tick-box exercise if there is no meaningful engagement. For instance, including a contract clause requiring certain human rights and environmental standards from the supplier can help to ensure compliance with the Directive (Articles 7 (b), 8 (c). However, this would only help to ensure that the supplier complies with human rights standards if the clause is clear and specific, is the result of meaningful collaboration between the parties, and its adherence is monitored and supported. Contract clauses, codes of conducts, certification schemes and the like can aid in setting standards and expectations, identifying liability, and providing a means to measure performance but this only works if they are used as a tool for HRDD rather than as a goal which is what often happens in practice.

Conclusion This Directive risks relying too much on mitigating the risks for the business. Legislation should have a human rights riskbased approach rather than a business risk-based approach as ‘human rights due diligence is fundamentally about assessing risks to people, rather than risks to the business.’32

Despite its flaws and the need to strengthen its provisions the Directive is nonetheless a considerable accomplishment

Despite its flaws and the need to strengthen its provisions the Directive is nonetheless a considerable accomplishment as it enshrines an obligation to perform human rights due diligence in the law and forms an important step towards furthering accountability for adverse human rights impact by corporations. Likely, the Directive will be adopted in early 2024 and Member States will have two years to start implementing the Directive in a progressive way starting with the largest companies; meaning it will likely take effect from 2027.

32. Shift, ‘the EU Commission’s Proposal for a Corporate Sustainability Due Diligence Directive Shift’s Analysis’ (2022), p. 7.