I. Introduction
With several states and the European Union (EU) considering legislative initiatives on mandatory human rights and environmental due diligence, France is in the spotlight with the Law on the Corporate Duty of Vigilance (the ‘Vigilance law’ or the ‘Law’) enacted in 2017.Footnote 1 Considered as ‘the best known and most far reaching’Footnote 2 regime of mandatory human rights due diligence, the Law stands out to date as the only law to be both enacted and implemented that incorporates such due diligence into domestic law.Footnote 3
The Vigilance Law presents a number of theoretical and practical challenges identified during the first years of its interpretation, implementation and enforcement. This article provides a consolidated account of these challenges and related analysis. It does so in three parts. First, it focuses on the challenges related to the scope of the Law and ambit of the vigilance plan. Second, it moves to the challenges connected to the interpretation and implementation of the obligations set forth in the Law. Third, it concludes with the challenges brought about by the enforcement and the civil liability mechanisms found in the Law.
A few caveats and comments before proceeding. This article, which seeks to reflect a multistakeholder view, presents a consolidated account of the existing challenges that have been encountered in practice as well as those that have been analysed and discussed by stakeholder reports and doctrinal studies so far. There are several additional challenges that remain unexamined including some more prospective ones. This article touches upon some of these challenges but does not provide for their detailed legal analysis. Moreover, while this article is focused on the Vigilance Law’s challenges, the innovative nature and the strengths of the Law should also be recognized as amply documented elsewhere.Footnote 4
II. Challenges Related to the Scope of the Vigilance Law and Ambit of the Vigilance Plan
A. The Identification of Companies Falling Within the Scope of the Law
One major issue is the identification of companies that fall within the scope of the Law. The issue has gained all the more attention as the enforcement of the Law is also dependent on the identification of companies falling within its scope. Parties with standing (including non-governmental organizations (‘NGOs’)) first need to identify non-compliant companies and can then decide to trigger the enforcement mechanism provided by the Law against such companies. There are three criteria which a company must fulfil to enter within the scope of the Law: it must (i) be registered in France (this criterion includes French subsidiaries of foreign groups), (ii) under a prescribed corporate form, and (iii) have a number of employees above certain thresholds. Such information on a company is not systematically public or easily identifiable. Additionally, experience has shown that the evolution of corporate entities and groups following events such as mergers, acquisitions and other restructuring further complicates the identification of relevant companies.
The French NGOs Sherpa and CCFD-Terre Solidaire (the ‘NGO Group’), using open data, carefully demonstrated that it was not possible to comprehensively identify companies falling within the scope of the Law due to insufficient public information. Based on such open data resources, the NGO Group nevertheless managed to identify a certain number of companies that fall within the scope of the Law and it published their names and vigilance plans (when such plans could be found) on a web platform named the ‘duty of vigilance radar’.Footnote 5 In 2020 the NGO Group also published a report identifying 265 companies which they determined as falling into the scope of the Law. Out of those, the report indicated that 27% of companies had not published a vigilance plan (including high profile companies from French or foreign groups).Footnote 6 The report provided a list of these companies (a total of 72 companies).Footnote 7 This proportion is likely to be even higher as the NGO Group may have been unable to identify whether additional companies fell within the scope of the Law due to the above-mentioned difficulties.
The NGO Group, joined by several other NGOs, together with some members of ParliamentFootnote 8 repeatedly asked the Ministry of Economy and Finance to disclose the list of companies falling within the scope of the Law, arguing that the Ministry should have access to the information required to establish such a list. In May 2019, the Minister of Economy and Finance tasked senior public servants at the General Council of Economy (a body attached to the same Ministry) with establishing this list together with the evaluation of the Law’s implementation.Footnote 9 The subsequent report, which was released in February 2020, explained that ‘it is impossible to establish a reliable list of the companies concerned. As regards their number, a broad and non-definitive range can be put forward between 200 and 250’.Footnote 10 This answer has been considered unsatisfactory by a number of NGOs and was even interpreted as a refusal to issue such a list.Footnote 11
The General Council of Economy proposed to amend the scope of the Vigilance Law in order to clarify it and simplify the identification of companies covered by the Law. Its suggestions included broadening the scope of the Law to more corporate forms, and considering turnover and/or balance sheet thresholds in addition to the existing employee thresholds.Footnote 12 It is, however, unclear, how adding a further criterion based on turnover or balance sheet thresholds to the existing three criteria would simplify the identification of relevant companies.Footnote 13
B. Corporate Forms of Companies Covered by the Law
Another theme that drew the attention of the first commentators of the Law focuses on the corporate forms of companies falling within the scope of the Vigilance Law. The Vigilance Law does not list such corporate forms. They can only be identified based on the location of the Vigilance Law’s provisions in the French commercial code. In particular, the debate revolves around one specific corporate form, the société par actions simplifiée (‘SAS’). This form has been increasingly generalized in France due to the flexibility of its structure.
An extremely limited number of scholars, together with the association of stock corporations (ANSA) whose membership includes listed and non-listed companies, argued in 2017 that the SAS was excluded from the scope of the Law. The rest of the commentators, across a wide spectrum ranging from scholars to practitioners of different specialities suggested the opposite.Footnote 14 This position was also supported by the French Government in 2017Footnote 15 and more recently by the General Council of Economy.Footnote 16 Today, the debate has faded away but could be rekindled should a SAS be brought to court under the enforcement or civil liability mechanisms set in the Law.
In practice, a number of SAS companies are preparing vigilance plans and making them public. However, there is high probability that several SAS companies, likely to meet the employee thresholds provided by the Vigilance Law, have not prepared vigilance plans. Whether or not these companies are deliberately trying to pass under the ‘Vigilance Law radar’, they are taking the risk of potential legal action for failure to comply with the Vigilance Law.
C. The Identification of Entities Within the Ambit of a Vigilance Plan
Another interpretative and practical challenge concerns the identification of companies falling within the ambit rationae personae (also called perimeter) of the vigilance plan that a company has to establish. This challenge, relatively overshadowed by the identification of companies falling within the scope of the Law, is no less important: the vigilance plan should cover the activities of the company, and its subsidiaries, but also suppliers and subcontractors with whom there is an established commercial relationship. Some NGOs requested that companies provide a list of such companies in their vigilance plan,Footnote 17 but so far it seems there is no evidence of companies having disclosed such a comprehensive list. Besides the public disclosure of such lists, it is indispensable for companies to be able to document the entities covered in their vigilance plan and how this identification has been conducted.
The challenge regarding the identification of companies falling within the ambit rationae personae of a vigilance plan fuels subsequent untapped interpretative questions. These questions include the delineation of the ambit of the vigilance plan when such a plan includes an exempted company and the delineation of suppliers and subcontractors when the vigilance plan covers ‘controlled companies’.Footnote 18 A challenge also remains as to what is an ‘established commercial relationship’ for the purpose of the Vigilance Law.Footnote 19 This debate is further complicated by the fact that a number of people unfamiliar with the Law think in terms of how suppliers and subcontractors are ranked with regard to a company’s value chain when trying to identify the suppliers and subcontractors falling within the ambit of its vigilance plan. This is incorrect reasoning given that the ‘established commercial relationship’ is the criterion and not the ‘rank’ of ‘business partners’ (two terms not featured in the Vigilance Law).
III. Challenges Related to the Vigilance Obligations
A. Selected Interpretative Questions
In relation to the first vigilance obligation, which consists of establishing a vigilance plan, the United Nations Guiding Principles on Business and Human Rights (‘UNGPs’) should be used as interpretative guidance as has been discussed elsewhere.Footnote 20 For instance, the Vigilance Law provides that the plan should ‘identify risks and prevent severe impacts on human rights and fundamental freedoms, on the health and safety of persons, and on the environment’. The notion of ‘severity’ from the UNGPs could be used to interpret the expression ‘severe impacts’ that is not defined in the Vigilance Law. The notion of ‘risks’, as the wording of the Vigilance Law makes it clear, designates the risks to rights-holders in line with the UNGPs (although a number of companies in the first year of implementation understood the risk as a risk to their companies rather than to rights-holders). As to the subject matters to be covered in a vigilance plan (i.e. human rights and fundamental freedoms, health and safety of persons, and the environment), most commentators have relied on the parliamentary debates, debates where reference is made to established international standards.Footnote 21 The human rights and health and safety angles have been the focus of most commentators of the Law, but the environment angle has gained increased importance in the past two years, including from a climate change perspective.Footnote 22 As to the five measures of the vigilance plan, the focus so far is mostly on how they can be implemented (see section III.B regarding these measures and their implementation).
The second obligation consists of the effective implementation by a company of its vigilance plan. This innovative provision sets the Law apart from legislation focused solely on reporting. Parliamentary debates provide elements of interpretation, albeit limited ones. NGOs and practitioners have explored what effective implementation means in practice and have tried to identify criteria constitutive of such ‘effective’ implementation.Footnote 23 This notion, however, is likely to fuel debates, especially in front of the courts that will have to assess whether a vigilance plan has been effectively implemented.
The Law sets out a third vigilance obligation providing that companies must make public their vigilance plan and the report on its effective implementation and include them in their annual management report. Note that according to the wording of the Vigilance Law, it has been suggested that this obligation should be read as meaning that the plan and report on its effective implementation should be made public (in the sense of being made accessible to the public) and included in the company’s annual management report.Footnote 24 While this interpretation has not yet been confirmed by courts, it has solid justifications.Footnote 25
Overall, it is still not clear how, in practice, courts will evaluate compliance with the three obligations (the ‘Vigilance Obligations’) within the context of the enforcement mechanism and the civil liability mechanism (see section IV for more developments on this point).
B. Guidance on the Implementation of the Vigilance Obligations
To date, there is no guidance from any French public authority as to how to implement the Vigilance Obligations and, specifically, the five measures of the vigilance plan.Footnote 26 The Vigilance Law provided that a decree issued by the Conseil d’Etat ‘could expand on the [five] vigilance measures […]. It may detail the methods for establishing and implementing the vigilance plan, where appropriate in the context of multi-stakeholder initiatives within sectors or at territorial level.’ The policy choice so far has thus been not to issue any specific guidance on the expected substance and format of vigilance plans and there is no sign that a decree will be issued in the near future. In the event such guidance were to be prepared, it is unclear what the drafting process would be and whether this process and the content of the guidance would satisfy all stakeholders, especially as such guidance could be viewed as setting a standard for companies and for courts. The recent report from the General Council of Economy actually suggested that the State could, without direct engagement, encourage good practices including through its procurement policies and through sectoral and multi-stakeholder initiatives.Footnote 27 What constitutes good practices, however, has not been clearly specified in the report.
Some guidance of varying comprehensiveness has been prepared by certain stakeholders presenting their interpretation of the Law. Nevertheless, such guidance is not necessarily considered authoritative among all stakeholders. The most complete guidance to date is the Vigilance Plan Reference Guidance, published both in French and English and prepared by the NGO Sherpa.Footnote 28 The reports from Entreprises pour les droits de l’Homme (EDH), reviewing the new generation of vigilance plans on a yearly basis also contain some guidance, including in the 2020 report that features the views of several stakeholders.Footnote 29 At present, it appears that business organizations do not provide public guidance to companies, in contrast to the guidance they offer on implementation of anti-corruption and non-financial reporting legislation.Footnote 30
C. Current Implementation of the Vigilance Obligations
The Vigilance Law has contributed to awareness raising within companies about the necessity of integrating human rights and environmental concerns within business activities and supply chains. A few companies have demonstrated a genuine effort to prepare detailed vigilance plans. However, many companies are still in a learning phase and the learning curve is steep.Footnote 31 Recent evidence shows that the companies ahead of the curve are getting more specific in the adapted actions they report as a response to the risks they have identified.Footnote 32 In contrast, other less advanced companies have compiled under their vigilance plans existing policies and processes, not fully engaging or understanding the objectives (and spirit) of either the vigilance plan or the Law. Overall, a number of companies still approach the vigilance plan as a tick-box exercise and are wary of transparency and stakeholder engagement.
Various stakeholder groups have conducted more or less in-depth analysis of vigilance plans released since 2018.Footnote 33 Their conclusions generally point toward a similar set of main weaknesses. These include, among others, the insufficient consultation of stakeholders (which nevertheless has been improving since 2018) and the lack of transparency, including the methodologies used. They also note the very general aspect of the vigilance plans with regard to the five vigilance measures. In particular, risk mapping generally refers to very generic risks (e.g. ‘child labour’, ‘discrimination’, ‘climate change’). The adapted actions and evaluation measures to be included in vigilance plans are often described in little detail. The alert and complaint mechanisms have slightly improved over the years: they are increasingly available to external stakeholders.Footnote 34 However, sometimes these mechanisms may not be easily accessible due to the communication channels used and the uncertain guarantees offered to protect users. Companies’ systems for monitoring implementation measures and evaluating their effectiveness also need to be further improved. Finally, companies are generally poorly performing on reporting the effective implementation of their vigilance plans, even those having more advanced vigilance plans.
Besides, several questions remain as to the implementation of the Vigilance Law. For instance, what is the expected level of detail of a vigilance plan and how much focus should there be on the granularity of the risk mapping (including whether the vigilance plan should be delineated per project)? How to build a robust methodology for identifying and prioritizing risks (especially in terms of content and disclosure of such methodology as part of the vigilance plan)? How to best identify and consult stakeholders? As to the ‘adapted measures to mitigate risk and prevent severe impacts’, there is no information as to what may constitute such measures. Other questions relate to how transparent a company should be when choosing what to disclose or not;Footnote 35 what is the impact on the Vigilance Law on managerial practices;Footnote 36 and how managerially speaking should the processes pertaining to the vigilance plan be best designed, implemented and gain internal traction.
IV. Challenges Related to the Enforcement and Civil Liability Mechanisms
A. Enforcement Mechanism
The Vigilance Law provides for a two-step enforcement mechanism (regardless of whether a damage has been sustained) consisting of (i) a formal notice to comply and then (ii) a request asking the competent court to order an injunction with a potential periodic penalty payment. Since 2019, the enforcement mechanism of the Law has been triggered seven times and three cases have reached the courts.Footnote 37 This situation is a positive signal that the mechanism is operational and several parties have utilized it. The courts’ first decisions will also be an important signal as to the actionability of the enforcement mechanism. These actions together with a detailed analysis of their legal stakes have been examined in further detail elsewhere and this article focuses on a few of the main interpretation and implementation challenges.Footnote 38
1. Admissibility
First, the enforcement mechanism can be seized by ‘any person with standing’. There are debates on who such persons are. Second, the Law does not provide whether the commercial or civil court is the ‘competent court’ to be seized in relation to the second step of the enforcement mechanism. A third question is on timing: the Law provides that, for the second step of the mechanism, it is possible to directly seize the president of the court in the context of interim/emergency proceedings (statuant en référé). However, the in concreto appreciation of such emergency character remains to be seen. These questions are central points of discussion in the first enforcement actions before the courts. In particular, in December 2020, the Versailles Court of Appeal confirmed that the commercial court was competent to examine the first enforcement case introduced before the courts.Footnote 39 How this decision will impact the enforcement mechanism, as well as other actions brought under the Vigilance Law, remains to be seen.
2. Substance
The court will have to evaluate the comprehensiveness of a vigilance plan and how effectively it is implemented, a situation that may prove challenging, and even more so for cases concerning situations taking place in remote regions. It remains to be seen whether courts will clarify the level of comprehensiveness expected in vigilance plans, the content of the different vigilance measures, and what ‘effective implementation’ of a vigilance plan means. There are a number of other questions, including the amounts of possible periodic penalty payments; how courts will require in their injunctions, if at all, that companies deploy detailed measures to comply with their Vigilance Obligations and then how courts will assess whether companies have complied with injunctions. Another point that is left unaddressed is the articulation between the injunction process in front of the courts (and more generally the compliance with the Vigilance Obligations) and the remediation process provided under the Vigilance Law when harm occurs.Footnote 40
The enforcement mechanism of the Vigilance Law relies on the actions of parties with standing who are the only ones to have legal capacity to trigger the mechanism. In practice, it is mostly NGOs and trade unions that have led the way initiating the first enforcement actions. Yet, the triggering of the mechanism is all the more challenging as these entities often have limited financial and operational capacity. Besides, this process can generate risks for human rights and environmental defenders. Several NGOs have been asking for the creation of ‘an independent monitoring body to ensure the effective implementation of the [L]aw’.Footnote 41 The General Council of Economy also noted in its report the weaknesses in the monitoring of the Law’s implementation and suggested that a body of the French administration should get access to confidential information centralized by the administration in order to promote compliance with the Vigilance Obligations. In particular, this body would engage with non-compliant companies (in addition to the existing enforcement and civil liability mechanisms).Footnote 42 It is, however, unclear at this stage what the composition and scope of action of such a body would be.
B. Remediation Mechanism
The Law also provides for a remediation mechanism consisting in a civil liability action in the event that a damage has occurred.Footnote 43 This mechanism raises a number of intertwined theoretical and practical questions that have been addressed in greater length elsewhere.Footnote 44 By way of reminder, the Law provides that companies failing to comply with the Vigilance Obligations will have to remedy the damage that ‘the execution of these obligations could have prevented’. The Vigilance Law’s civil liability regime is centred on the parent or instructing company’s own fault (i.e. a breach of the Vigilance Obligations). There may be debates, similar to those relating to the enforcement mechanisms, as to which parties have standing to bring cases. An additional major challenge left unaddressed relates to private international law: it is uncertain whether the Law will apply when damage occurs outside of France.Footnote 45
As indicated in the parliamentary debates, the Vigilance Law requires that companies take all steps in their power to reach a certain result (obligation de moyens) rather than requiring from them the attainment of that result (obligation de résultat).Footnote 46 In practice, would courts consider that a very general and/or short vigilance plan and limited actions to effectively implement such a plan are sufficient to consider the company has complied with the Vigilance Obligations and not committed a fault?Footnote 47 Could courts possibly settle for a middle ground consisting of a presumption of a fault from the company but that could be reversed in broader circumstances than just force majeure (obligations de moyens renforcées)? Some commentators have also considered that the Law could be viewed as setting a “standard of behaviour” that courts will have to consider based on different elements, including the practices of companies.Footnote 48 In any event, the courts are likely to assess the effective implementation of a vigilance plan by relying on a body of evidence including, for instance, the financial and material means a company allocates to the implementation of the Vigilance Obligations, and/or the actions deployed on the ground and associated indicators measuring their effectiveness.
The claimants bear the burden of proof. They will have to prove that the Vigilance Law is applicable to their situation and that their case satisfies all three conditions under the general law of torts: a damage, a breach of one of the obligations defined in the Law and a causal link between the damage and the breach of the obligation.Footnote 49 The more remote in the supply chain the damage, the harder it may be for the claimant to prove that the damage has occurred as a result of a breach of the Vigilance Obligations and that there is causal link between such breach and the damage. This proof may be even more complex as it will not be possible to infer from a damage that there has been a breach of the Vigilance Obligations.Footnote 50 There may also be several other barriers that can prevent victims from taking any legal action before the courts, including material, social, cultural, institutional and linguistic circumstances.Footnote 51 With the objective of overcoming these challenges, several NGOs are calling for a shift in the burden of proof so that such burden does not fall on the claimant.Footnote 52
V. Conclusion
The challenges that have emerged since the Law’s enactment may also reveal underlying tensions in terms of policy choices including tensions between precise provisions and broader, potentially more adaptive ones; tensions between pedagogy and enforcement as well as their respective timings; and tensions regarding the allocation of resources for implementing and enforcing the Law between stakeholders (from companies to NGOs), judges and, possibly, other administrative bodies.
That being said, the Vigilance Law has been considered as a legislative breakthrough in the business and human rights galaxy.Footnote 53 It acted as a ‘passe-muraille’ lawFootnote 54 meant as a first step to overcome barriers to prevention and remediation of adverse human rights and environmental impacts along value chains and to spur a legislative movement that would go beyond France’s borders. Its innovative provisions are indeed now serving as inspiration for various legislative initiatives on human rights and environmental due diligence across the world, including at the EU level. As for the challenges that have emerged since the Law’s enactment, as well as the underlying tensions, they should equally serve to enlighten the policy debates preceding the design of these future legislative initiatives.