Muddying the Waters: The Concept of a ‘Safe Harbour’ in Understanding Human Rights Due Diligence

Abstract

The concept of a ‘safe harbour’ has been mentioned in several contexts during ongoing discussions around regulatory developments towards mandatory human rights and environmental due diligence (mHREDD) which continue at international, European and national levels. This article analyses the concept of a ‘safe harbour’ and how it relates to human rights due diligence (HRDD) as described in the UN Guiding Principles on Business and Human Rights (UNGPs). It discusses examples of other types of safe harbours which were recognized in legislation and case law; considers that a safe harbour could result in a ‘tick-box’ approach; highlights the implications for access to remedy; and distinguishes a safe harbour exemption from a defence of having undertaken HRDD in accordance with an expected standard of conduct.

I. Introduction

Recently, important developments have taken place as an increasing number of mandatory human rights and environmental due diligence (mHREDD) laws and legislative proposals have been put forward in various jurisdictions in Europe and beyond, ¹ supported by civil society, ² trade unions ³ and a growing number of business organizations ⁴ and companies. ⁵

In Europe more specifically, the majority of stakeholders consulted in the 2020 European Commission Study on Due Diligence Requirements Through the Supply Chain (EC study) ⁶ supported the introduction of an EU-level general mHREDD requirement. ⁷ This was perceived by stakeholders across the board as the regulatory option which would yield the greatest positive social, environmental and human rights impacts, and nearly 70% of companies surveyed anticipated that mHREDD legislation would benefit business. ⁸ Based on the findings of this study, the European Commissioner for Justice, Didier Reynders, announced that a legislative initiative on mHREDD would be put forward. ⁹ In March 2021, the European Parliament adopted a resolution with recommendations to the European Commission on corporate due diligence and corporate accountability, including the text for a draft directive in the annex. ¹⁰ On 23 February 2022, the European Commission published its proposed Directive on Corporate Sustainability Due Diligence (EC Draft Directive), ¹¹ which sets out mHREDD duties for large European and non-European companies as well as mid-cap companies active in specified ‘high impact’ sectors, and includes state-based oversight mechanisms alongside civil remedies.

These legal developments are expressly based on the concept of human rights due diligence (HRDD) set out in the UN Guiding Principles on Business and Human Rights (UNGPs) where it is defined as the process through which companies can ‘identify, prevent, mitigate and account for’ the actual and potential adverse human rights impacts that they may cause or contribute to through their own activities, or which may be directly linked to their operations, products or services by their business relationships. ¹² The concept was subsequently introduced in various international instruments such as the ILO Tripartite Declaration of Principles concerning Multinational Enterprises and Social Policy ¹³ and the OECD Guidelines for Multinational Enterprises ¹⁴ where it was extended to other fields such as the environment.

However, the UNGPs ¹⁵ only make limited references to the concept of legal liability, and specify that ‘the responsibility of business enterprises to respect human rights is distinct from issues of legal liability and enforcement, which remain defined largely by national law provisions in relevant jurisdictions’. ¹⁶ At the same time, the UNGPs make it clear that access to remedy is an essential part of both the state duty to protect and the corporate responsibility to respect human rights. In relation to the latter, the idea embodied in the UNGPs is that due diligence should help companies mitigate their legal risk: the Commentary to Principle 17 states in this respect that:

Conducting appropriate human rights due diligence should help business enterprises address the risk of legal claims against them by showing that they took every reasonable step to avoid involvement with an alleged human rights abuse. However, business enterprises conducting such due diligence should not assume that, by itself, this will automatically and fully absolve them from liability for causing or contributing to human rights abuses.

It is in relation to these discussions on the legal defence to liability that the concept of a ‘safe harbour’ has surfaced in the context of corporate due diligence. For example, an unofficial publication of Draft Key Points for the purposes of introducing a German Federal law on strengthening corporate due diligence to prevent human rights violations in global value chains (hereafter ‘German Draft Key Points’) ¹⁷ was released in 2020 and made express reference to a ‘safe harbour’ exemption. This provision did not feature in the Supply Chains Due Diligence Act which was finally approved in Germany, ¹⁸ but references to the concept of ‘safe harbour’ remain in circulation.

For example, the ‘safe harbour’ concept was mentioned in a panel discussion on the topic of ‘Mandatory Human Rights Due Diligence: building out the key components of effective legislation’ during the 2020 UN Forum on Business and Human Rights. ¹⁹ In October 2021, the International Organisation of Employers, together with Business at OECD and BusinessEurope, released a joint position paper which mentions the removal the ‘safe harbour’ provision which was contained in the Third Revised Draft Treaty on business and human rights. ²⁰ It was reported that during the negotiations between EU Member States regarding the EC Draft Directive, a German proposal for a ‘a get out of jail free card’, ²¹ described as ‘an amendment that would allow companies to be largely exempt from liability if they were part of an industry initiative to address issues along the value chain’ did not ‘get much traction and is unlikely to be included in a new compromise text’. ²²

However, in the context of these discussions, important confusions have emerged as ‘safe harbour’ is often used as a synonymous for a ‘due diligence defence’. For example, since the publication of the EC Draft Directive, initial responses and social media comments have – incorrectly, we argue – implied that its Article 22(2) functions effectively as a safe harbour exemption. ²³ This article argues that these two concepts should be firmly distinguished: a ‘due diligence defence’ requires the company to demonstrate the quality of its due diligence, whereas a ‘safe harbour’ excludes such an enquiry from taking place, based on the company having met a certain conditional requirement.

This article considers what is meant by a ‘safe harbour’ in this context, and how this concept differs from the concept of mHREDD as a legal standard of care which forms the basis of a legal defence to liability. In particular, Section II presents the concept of ‘safe harbour’ through three illustrative examples. Next, Section III distinguishes the concept of ‘safe harbour’ from the concepts of mHREDD as a standard of care and the ‘due diligence defence’, and considers how the ‘safe harbour’ concept relates to a ‘tick box’ approach, the UNGPs framework, and access to remedy for victims. The article concludes that the concept of ‘safe harbour’ should not be used interchangeably or synonymously with the concept of a ‘due diligence defence’ associated with a legal standard of care.

The methodology used is a literature review and comparative legal analysis. The article focuses on the (in)compatibility of a ‘safe harbour’ exemption with the concept of mHREDD, with reference to selected illustrative examples, existing research findings and ongoing legal developments. As such the article aims for a conceptual legal analysis within the framework of the UNGPs rather than comprehensively covering individual jurisdictions.

II. The Concept of a ‘Safe Harbour’ Exemption

Understanding of the Concept of ‘Safe Harbour’: Three Illustrative Examples

In certain areas of law, the phrase ‘safe harbour’ is used to describe specific conditions which, if met, exempts an entity from liability. The concept of ‘safe harbour’ has been used in different contexts and has not been centrally defined in a uniform way. However, the meaning always broadly relates to condition(s) set out or implied in a statute, which, if proved to have been met, would exempt an entity from liability in terms of the statute. This meaning will be considered here through three illustrative examples (which are not exhaustive of the way in which the phrase is used).

‘Safe Harbour’ and California Reporting Requirements: Barber v Nestlé

The first example relates to the California Supply Chain Transparency Act, ²⁴ which requires certain companies to report on the efforts they are taking to eradicate slavery and human trafficking from their direct supply chain. The case of Barber v Nestlé ²⁵ heralded a line of claims based on consumer protection laws ²⁶ relating to statements made in terms of this Act. The cases alleged that the failure to disclose that certain products may have been sourced by forced labour had materially influenced and deceived the plaintiffs in their purchasing choices.

The Court in Barber found that when adopting the Supply Chains Transparency Act, the California legislature had: ²⁷

[C]onsidered the situation of regulating disclosure by companies with possible forced labor in their supply lines and determined that only the limited disclosure mandated by § 1714.43 is required.

It found that the information which the plaintiffs required was additional to the information required by the Act. The Court found in favour of the company that, because the company had complied with the specific requirements of the Act, the plaintiffs’ claim was barred by the ‘safe harbour doctrine’. The Court also stated: ²⁸

Plaintiffs may wish – understandably – that the Legislature had required disclosures beyond the minimal ones required by § 1714.43. But that is precisely the sort of legislative second-guessing that the safe harbor doctrine guards against.

In other words, it was considered that the legislature stipulated which information should be included within the public statement, and by complying with these specific requirements of the Act, the company was protected by the ‘safe harbour’. In the context of this first illustrative example, the concept of ‘safe harbour’ was read into the legislation by the court, as the statute it referred to did not explicitly provide for a ‘safe harbour’ provision. It functions as a way of shielding companies from liability for failing to disclose information beyond that which is expressly required by the reporting statute.

‘Safe Harbour’ and European Data Privacy Regulation: Schrems v Data Protection Commissioner

A second example of a reference to concept of ‘safe harbour’ can be found in the context of the EU, with the decisions of the Court of Justice of the European Union (CJEU) in Schrems v Data Protection Commissioner (Schrems I). ²⁹ The case related to the Commission’s decision which provided that companies which self-certified as adhering to US Department of Commerce ‘Safe Harbour Privacy Principles’ of 21 July 2000 (and the FAQs relating to their implementation) would be deemed to meet the conditions required for the transfer of personal data from the EU to the US. In a judgment which predated the General Data Protection Regulation (GDPR), ³⁰ the CJEU found that the European Commission’s decision to create a ‘safe harbour’ exemption was invalid, as it did not adequately protect the fundamental rights and freedoms, particularly the right to privacy, set out in the European Convention for the Protection of Human Rights and Fundamental Freedoms. This provides an interesting example of an express ‘safe harbour’ provision which was declared invalid for failing to adequately protect human rights.

In addition, the Court held that ‘legislation not providing for any possibility for an individual to pursue legal remedies’ in this context ‘does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the [EU] Charter [of Fundamental Rights]’. ³¹ It elaborated as follows: ³²

The first paragraph of Article 47 of the Charter requires everyone whose rights and freedoms guaranteed by the law of the European Union are violated to have the right to an effective remedy before a tribunal in compliance with the conditions laid down in that article. The very existence of effective judicial review designed to ensure compliance with provisions of EU law is inherent in the existence of the rule of law.

As a result, in the European context and, arguably in other contexts as well, a ‘safe harbour’ provision which precludes or limits rights-holders from bringing civil claims against a company may similarly be understood to interfere with the right to an effective remedy.

‘Safe Harbour’ in the German Draft Key Points

The most recent of our three illustrative examples is the safe harbour provision which was contained in the German Draft Key Points ³³ which related to earlier drafts of what is now the German Law on Supply Chain Due Diligence. ³⁴ The German law which was eventually passed no longer contains the ‘safe harbour’ exemption, but it is nevertheless illuminating to consider this example for current purposes.

The German Draft Key Points were produced by the Federal Ministry of Labour and Social Affairs and the Federal Ministry for Economic Cooperation and Development and released in July 2020. The Draft Key Points sought to impose mHREDD obligations derived from the UNGPs and the OECD Guidelines for companies resident in Germany with more than 500 employees. The due diligence exercise envisaged included an identification and an analysis of the risks of potential or actual adverse impacts on internationally recognized human rights, a requirement to take appropriate measures to address these impacts and to check the effectiveness of the measures taken, the need for companies to set up a complaints mechanism, and the obligation to report annually on the various core elements of the due diligence process. The due diligence exercise was to be proportionate and reasonable in view of the nature and scope of the business activity.

In terms of enforcement, the Draft Key Points contained a civil liability provision which would allow private parties to bring actions for damages in German courts against companies alleged to have violated the due diligence obligations. The civil liability provision specified that a company would have been liable for harm which was ‘foreseeable and avoidable’. The provision also provided for a due diligence defence, whereby a company would not have been liable for damages if it could show that it had done what was appropriate under the circumstances, and that the damage nevertheless occurred. The obligation was described in the Draft Key Points as an obligation of effort (Bemühungspflicht) and not as an obligation of successful result (Erfolgspflicht).

In addition to the civil liability provision, the Draft Key Points contained a provision entitled ‘safe harbour’, which provided that where a company joined and implemented ‘an officially recognised (industry) standard’ it would be exempted from civil liability for failure to undertake the required due diligence, except in cases of intent and gross negligence. The criteria for a ‘recognised (industry) standard’ would have been listed in the legislation, and would have included that the standard ³⁵ should cover the entire supply chain; should take into account all the core elements of due diligence; and should have been developed in the framework of a multi-stakeholder process. The text also provided that the company’s compliance with the standard was to be externally audited.

As discussed below, a ‘safe harbour’ provision which relies exclusively on industry standards poses some contradictions to the concept of HRDD, particularly as involvement in a MSI standard does not guarantee an adequate HRDD process. ³⁶

Neither the civil liability nor the safe harbour provisions were included in the text that was subsequently adopted as the German Corporate Due Diligence Obligations in Supply Chains Act in June 2021. The latter imposes on certain large German companies due diligence obligations with regard to human rights and certain environment-related risks. The due diligence obligations extend to the companies’ own operations and to their first-tier suppliers. In some cases, it may extend further down the supply chain. Unlike the Draft Key Points, enforcement of the adopted law will take place exclusively through a state-based administrative oversight body. The authority will be empowered to act on its own accord, receive complaints, and impose fines, but with no specific powers relating to remedies for victims.

Although these illustrative examples provide different – and non-exhaustive – contexts within which the concept of ‘safe harbour’ have been used, their commonality lies in the automaticity of the exemption from liability which is characteristic of the ‘safe harbour’. This is not only highly problematic from an access to justice perspective but also, as will be demonstrated next, contrasts with the UNGPs’ understanding of the concept of HRDD as a standard of care. This was confirmed by John Ruggie who stated, in a January 2021 webinar on corporate due diligence and civil liability, that: ‘Given that [with HRDD] we are dealing with a standard of conduct, there should be, in my view, a due diligence defence, but not an automatic safe harbour’. ³⁷

III. The Concept of ‘Safe Harbour’ in the Context of mHREDD as a Standard of Care

The Concept of mHREDD as a Standard of Care and the ‘Due Diligence Defence’

As set out in the UNGPs, the concept of HRDD refers to a standard of care that is a standard of conduct which would be expected from a reasonable company based on the specific circumstances. Such a standard of care is ‘based on the basic tort law or negligence principle – phrased differently but similar in nature across civil and common law jurisdictions – being that a person should take reasonable care not to cause harm to another person’. ³⁸ As such, within that general understanding, mHREDD as a standard of care does not envisage creating a strict liability obligation without a defence. Such a strict liability would ostensibly require the elimination of all human rights harms, insofar as the existence of any human rights harm in the company’s operations or value chain would automatically translate into liability.

In line with the UNGPs, the new EC Draft Directive on Sustainable Corporate Due Diligence ³⁹ acknowledges this in Recital 15 by specifying that the main due diligence obligations set out in the Directive are ‘obligations of means’ whereby companies should take the ‘appropriate measures which can reasonably be expected to result in prevention or minimisation of the adverse impact under the circumstances of the specific case’. It further affirms that:

This Directive should not require companies to guarantee, in all circumstances, that adverse impacts will never occur or that they will be stopped. For example with respect to business relationships where the adverse impact results from State intervention, the company might not be in a position to arrive at such results.

Instead, due diligence as a standard of care necessarily offers the possibility of a due diligence defence to liability, where the legal test would focus on whether and how the company has exercised appropriate care: in other words, whether the company has taken objectively sufficient steps to ‘identify, prevent, mitigate and account for’ their actual and potential human rights abuses. ⁴⁰ Any duty that is defined with reference to a standard of care would by implication allow a defendant company to show, when challenged in court, that it has in fact met the legally required standard of care. It is the level, quality and degree of the company’s efforts that would determine whether it has met the legal requirement.

Indeed, the due diligence process itself would involve an evaluation of those risks. This can be contrasted with a situation where a company is automatically strictly liable, without a defence, for any proven harm which it was legally obliged to avoid or prevent. Such a law could discourage companies from proactively taking steps to identify and address adverse impacts. In other words, companies might be incentivized to ‘disassociate and deny’, rather than ‘engage and improve’. ⁴¹

All defendants in court, whether civil or criminal, are always able to defend themselves by arguing and proving that they have not breached the law in the way that is alleged. ⁴² In this context, it is this civil defence on the merits that is called the ‘due diligence defence’, to be distinguished from a ‘safe harbour’ exemption which rules out an enquiry on the merits.

Below, the article sets out various ways in which the concept of a ‘safe harbour’ exemption contradicts the concept of mHREDD and the ‘due diligence defence’.

‘Safe Harbour’ as a Defence

Despite the overall support for the introduction of mHREDD at the EU level, some business representatives have expressed concerns in relation to the increased legal risks that it might pose for them. Against this backdrop, the concept of ‘safe harbour’ has started to be used in relation to HRDD, as a way in which companies can avoid liability. For instance, in an interview, Virginie Mahin, the Global Social Sustainability and Human Rights Lead at Mondelez International indicated that: ⁴³

In cocoa, for example on child labour, we have multistakeholder industry initiatives. We have the International Cocoa Initiative where we work collectively on tackling child labour issues in the West African supply chain. […] But while there are a lot of good voluntary initiatives, we still think it would be beneficial to have a binding law at EU level to provide a level playing field, and bring along companies upstream in the supply chain, which may not be under the same consumer-facing pressure. And the law should provide that safe harbour we are talking about. That is essential to us.

Whilst acknowledging that enforcement mechanisms are key to ensuring the effectiveness of a law, Mahin also articulated concerns of legal actions being filed on the basis of the information shared by the company. She explained that:

Companies need to have confidence they can be transparent about risks in their supply chains without fearing that they will be exposed to increased risk of litigation. We need to make sure that when we are transparent, we are not exposed.

Similarly, in an interview for the EC study, a company interviewee explained the need to allow companies the freedom to recognize their issues in a transparent manner and to try and solve the issues without being immediately found liable for these issues. ⁴⁴

These references to a ‘safe harbour’ accordingly point to the need expressed for companies to be transparent about how they address their human rights risks, without thereby subjecting themselves to increased legal risks. The fear that increased transparency would lead to increased legal risk might also have been fuelled by case law such as the UK case of Vedanta, ⁴⁵ where the company’s own statements were deemed to be relevant to the court’s assessment of whether the parent company may have assumed a duty of care.

These comments preceded the legal proposals which are under discussion in this article. In contrast to the concerns expressed above, the legal duty is not being developed on a strict liability basis where any company that is associated with human rights harms (or reporting transparently) would automatically be liable. Instead the legal test would consider what the company has done to address these risks. Insofar as communication is an important component of HRDD, companies that are able to ‘know and show’ how they address their human rights impacts should accordingly be in a better position to rely on the due diligence defence. Moreover, since these interviews took place, increasing transparency requirements, including in the EU Corporate Sustainability Reporting Directive, ⁴⁶ have evolved the legal obligations of companies to report on their HRDD.

‘Safe Harbour’ and the ‘Tick-Box’ Approach

An approach which automatically exempts companies which undertake ‘tick-box’ approaches were expressly rejected by stakeholders during the EC study. ⁴⁷ It was pointed out that this approach detracts resources away from those issues which are really at risk in the circumstances, towards those which are listed in the standard or instrument. ⁴⁸ Rather, stakeholders preferred a general duty which references a standard of care that would take into account the specific circumstances applicable to each company’s operating context.

A ‘tick-box’ approach is understood to refer to a list of criteria that applies across the board to companies and is unrelated to their real human rights risks or the quality of their due diligence processes. This approach allows a company to meet the legal requirement by simply ‘ticking off’ these criteria superficially, without consideration of the company’s real adverse human rights impacts and whether they are being addressed. If the relevant evaluating body does not evaluate the effectiveness of these efforts, then the company can avoid liability by simply having them in place, regardless of their adequacy, how well they are implemented in practice or their actual impacts on the lives of rights-holders.

Examples of such ‘tick-box’ criteria often include the use of contract clauses and audits. For example, the distinction between a ‘tick-box’ approach and a legal duty of care can be illustrated in the 2020 ‘Shrems II’ decision of the European Court of Justice in which the court had the opportunity to consider whether ‘standard contract clauses’ (SCCs) constituted a valid means of transferring personal data to non-EU third countries. ⁴⁹ The court concluded that such SCCs could be valid, but not in all cases. Specifically, the court said that organizations must assess on a ‘case-by-case basis… whether the law of the third country… ensures adequate protection’ of the transferred data, pursuant to the SCCs and ‘additional safeguards’ where necessary. ⁵⁰ The judgment highlights well the difference between a tick-box approach (in this case, the simple adoption of standardized contract clauses) and the more detailed sort of enquiry which the court deemed necessary to discharge an organization’s legal duties under the GDPR.

This finding is important in light of the provisions of the EC Draft Directive that relate to contractual assurances. In particular, Article 22(2) provides that companies would not be liable for damages:

… caused by an adverse impact arising as a result of the activities of an indirect partner with whom it has an established business relationship [where the company demonstrates that it has taken the actions referred to in sections relating to 7(2)(b) read with 7(4) and 8(3)(b) read with 8(5), relating to contractual assurances sought, contractual cascading and ‘appropriate measures to verify compliance’], unless it was unreasonable, in the circumstances of the case, to expect that the action actually taken, including as regards verifying compliance, would be adequate to prevent, mitigate, bring to an end or minimise the extent of the adverse impact. [Emphasis added]

Some initial media responses were concerned that this would constitute a ‘safe harbour’ or ‘tick-box’ approach, whereby companies would be exempt from civil liability for harms caused by indirect business partners in their value chain through the mere act of including contractual assurances. However, this is patently not the case: by referring to the ‘unreasonable[ness]’ and ‘adequa[cy]’ of the ‘action actually taken’ ‘in the circumstances of the case’, the law echoes the classic standard of care test applicable to civil disputes more generally: ⁵¹

This incorporates an objective ‘reasonableness’ standard into the defence. While it will be for the relevant courts to determine what is reasonable in all the circumstances, it is clear that companies will not be able to simply incorporate contractual obligations into their contracts with direct business partners without more, relying upon ‘contractual cascading’ to ensure these obligations reach indirect business partners. In many cases, depending on the risks, this will not be reasonable and therefore sufficient for the defence.

Whilst the EC Draft Directive’s ‘heavy reliance’ on contractual clauses and third-party verification methods to demonstrate compliance has been rightly criticized, ⁵² it is clear that the appropriateness of the measures taken by the company (as defined in recital 29 and in Article 3(q)) will be decisive in the court proceedings. The question therefore will be whether, under the circumstances of the specific case, and in relation only to those harms caused by indirect business partners, the company did in fact comply or fail to comply with its due diligence obligations set out in these subsections. ⁵³

This approach is reminiscent of that taken by the court in Schrems II which recognized the use of contractual clauses but required assessment of adequacy on a case-by-case basis. ⁵⁴ It is also interesting to note, in this regard, the judgment of Hamida Begum v Maran ⁵⁵ where the Court of Appeal of England and Wales considered an example of what the EC Draft Directive calls ‘contractual cascading’. It found that where both contracting parties knew that the relevant contractual clause regarding the protection of safe working practices ‘would be entirely ignored’, and where ‘everyone turns a blind eye to what they know will actually happen’, ⁵⁶ the company could be held liable insofar as it ‘could, and should, have insisted’ ⁵⁷ that the contractual provision be complied with by the contracting party in its own value chain.

However, as mentioned above, defining mHREDD as a legal duty to meet a certain standard of care necessarily implies that a company could defend itself by showing a court that it has met this duty. The key distinction is between the civil procedural definition of a defence, which any defendant can rely on in court, and a ‘safe harbour’ exemption which entirely rules out the cause of action ab initio.

Some have expressed discomfort with the use of the concept of ‘safe harbour’ in the context of mHREDD as a legal standard of care. For instance, in the EC study, an interviewee from civil society mentioned that: ⁵⁸ ‘In this debate, the concept of ‘safe harbour’ is not a very helpful concept, because it is mixing things together’. It was explained that whereas the UNGPs were clear that ‘conducting [due diligence] should not be an automatic defence’, it is the ‘issue of automaticity that is the problem’ insofar as ‘“safe harbour” implies “I do this, snap, I’m free, whatever happens I’m out”’.

There is accordingly a crucial difference between the defence of having undertaken the due diligence required by a duty of care, and a ‘safe harbour’ exemption. Nevertheless, these two concepts are often used in the same sentence, or even as synonyms, by commentators in ongoing discussions.

‘Safe Harbour’ and External Verification Methods

Some examples of ‘safe harbour’ or ‘tick-box’-centred approaches allow the company to show that it has obtained a report or document (sometimes actually entitled ‘due diligence’) from auditors, lawyers or consultants, or a certification or approval from a third-party verification scheme, in order to satisfy a legal requirement. It is a common precondition of contractual or public procurement frameworks for companies to demonstrate that they have achieved external verification as regards their compliance with internationally recognized standards issued by, for example, the International Organization for Standardization (‘ISO’) on matters such as health and safety or information security. This certification process is invariably conducted by way of external audit.

With a legal duty which comprises a standard of care, a document or certificate would not in itself suffice to end the enquiry. The court may take the verification into account, but the court’s enquiry would go further and ask what the company did in practice, on the facts of the case, and whether this was enough, ‘adequate’ or ‘reasonable’, given the specific circumstances and risks.

For example, a company with an ISO 37001 (anti-bribery management systems) compliance certificate would not automatically be deemed to have ‘adequate procedures’ in place for the purposes of establishing a defence to criminal liability under section 7 of the UK Bribery Act (failure to prevent bribery). As noted in guidance published by the UK Ministry of Justice, anti-bribery procedures need to be ‘effectively implemented and enforced’. ⁵⁹ In other words, satisfying the defence would require the defendant company to show that it maintained procedures which were effective in preventing bribery on an ongoing basis.

If it were the case that liability could be avoided under the UK Bribery Act through the simple act of having a compliance programme, regardless of its effectiveness (e.g., a set of ‘paper policies’ which are not applied in practice), this would be akin to a ‘tick-box’ defence. However, UK prosecutors have made clear that, in fact, having an ineffective compliance programme at the time of the offence is a public interest factor which tends in favour of the company’s prosecution. ⁶⁰

In other words, maintaining anti-bribery procedures which are not applied in practice may put the company in a worse position than having no procedures at all: in such circumstances the company may be regarded as having misrepresented its commitment to bribery prevention. In 2018, the UK Competition and Markets Authority similarly made clear that ‘the mere existence of compliance activities’ would not be treated as a mitigating factor when calculating fines for anti-competitive behaviour. ⁶¹ This represents the antithesis of a ‘tick-box’ approach. Indeed, an ineffective process that is simply aimed at ‘ticking off the boxes’ would be detrimental to the company’s case.

With a ‘tick-box’ (or, arguably for our purposes, a ‘safe harbour’ approach) it is accordingly the legislator (or regulator, acting pursuant to delegated powers) who decides which kind of conduct is excused from liability, with reference to a checked list of factors (which may or may not be circumscribed in the statute or outsourced to recognized verifiers). In contrast, with a duty to exercise a standard of care, especially where a statutory or civil remedy accompanies the duty, it would be for the court (or the regulator) to decide whether the relevant conduct meets the statutory duty of care, on the facts of the case, and the weighing of the evidence. ⁶² This enquiry would be based on the specific circumstances applicable to the averments before the court, including the risks, the knowledge that the company had or ought to have had, ⁶³ and what would have been expected of the reasonable company under those circumstances. ⁶⁴

In this situation, exercising due diligence may help companies to ‘show… that they took every reasonable step’ but would not ‘by itself… automatically and fully absolve them from liability’. ⁶⁵ Given the context and facts-specific nature of the duty of care, the legislation should not be over-prescriptive in terms of detail. This is particularly important in light of the warning of the OHCHR against the risks of a duty that is ‘overly detailed and proscriptive’ as this may lead to ‘narrow, compliance-orientated, “check-box” processes’. ⁶⁶ In this respect, a study which considered whether the criminal offence of failing to prevent bribery set out in the UK Bribery Act, referenced above, could be used as a model for a HRDD regulation found that:

[A] pure procedural “check box” or “safe harbour” provision that would shield a company completely from liability if any kind of human rights due diligence was performed, would not be aligned with the concept of due diligence contained in the UNGPs. ⁶⁷

Instead, the study argued that a due diligence defence to a failure to prevent mechanism would ‘allow a company to avoid liability where it can show that it had in place a robust system of human rights due diligence’. ⁶⁸ The expected level of due diligence expected would be based on the specific circumstances and determined by the court with reference to a number of relevant factors including the company’s size, sector, operations, risk, and the relevant industry standards. ⁶⁹

Another important argument against a ‘safe harbour’ exemption which relies on external standards, such as involvement with an MSI, having made a public statement, or having obtained a third-party verification, is that this action in itself does not substitute or guarantee an adequate HRDD process. For example, an MSI Integrity report concludes, after having researched 40 international standard-setting MSIs over the past decade, that ‘MSIs have not lived up to their promise of advancing rights holder protection against business-related abuses’ and that ‘MSIs are unlikely to ever be reliable tools to protect human rights’. ⁷⁰ As a result, it has been argued that participation in MSIs cannot in itself serve as a ‘blanket proof’ approach to human rights and environmental due diligence. ⁷¹

Accordingly, these external measures are not capable of being used as ‘safe harbour’ type substitutes for the individual, ongoing HRDD that is required of each company in terms of the UNGPs. Rather, in assessing the sufficiency of a company’s actions (and its potential legal liability) reference to a company’s adherence to an MSI standard, a third-party verification, its public statement or contractual clauses, would need to comprise important parts of a context-specific review of the particular circumstances.

‘Safe Harbour’ and the UNGPs

The EC study found that due diligence as a standard of care is the kind of exercise which courts make on a daily basis. ⁷² In particular, it was noted that the emphasis of the case law analysis will normally be on the adequacy of the due diligence exercise in the circumstances, rather than on the formalities of the due diligence process, and that, ‘the simple fact of having a so-called “due diligence” process in place does not automatically show that the standard of care was met’. ⁷³

By using a context-specific risk based enquiry, the standard of care approach described above aligns with the concept of HRDD in the UNGPs, which survey respondents and interviewees in the EC study stressed should not be abandoned. ⁷⁴ In this respect, the UN Office of the High Commissioner for Human Rights (OHCHR) Interpretive Guide to the corporate responsibility to respect human rights defines human rights due diligence as: ⁷⁵

Such a measure of prudence, activity, or assiduity, as is properly to be expected from, and ordinarily exercised by, a reasonable and prudent [person or enterprise] under the particular circumstances; not measured by any absolute standard, but depending on the relative facts of the special case. [Emphasis added].

This bears a notable similarity to the language used by Baron Alderson (a nineteenth century English judge) in defining the concept of negligence in Blyth v Birmingham Waterworks Company, ⁷⁶ one of the foundational cases of English tort law:

Negligence is the omission to do something which a reasonable man, guided upon those considerations which ordinarily regulate the conduct of human affairs, would do, or doing something which a prudent and reasonable man would not do.

The judge found the defendant not liable, as the broken water pipe which flooded the claimant’s property had been caused by extraordinarily low temperatures which were not common ‘south of the polar regions’. Rather than holding the defendant liable to an absolute standard, the judge concluded that the freezing conditions represented a ‘state of circumstances… a contingency against which no reasonable man can provide’. This contextual approach remains a feature of negligence law, and reflects that adopted in the Interpretive Guide, referenced above. ⁷⁷

Again noting the dangers of the ‘tick-box’ approach, the OHCHR Report on the relevance of HRDD to determinations of corporate liability notes that whilst a due diligence defence could ‘incentivize companies to meaningfully engage’ in human rights due diligence and ‘have important preventative effects’, it raises some serious concerns in ‘cases where superficial “check box” approaches to human rights due diligence might be used as a reference point instead of genuine attempts to identify, mitigate, and address human rights risks as contemplated in the UNGPs’. ⁷⁸ The report highlighted in this respect the importance of ensuring the familiarity of the judges with the content of the UNGPs in relation to the human rights due diligence expectations in order to enable them to ‘distinguish genuine efforts by business enterprises to identify and address risks from superficial efforts, and make their decisions accordingly’. ⁷⁹

Removal or Privatization of Remedy

Access to remedy forms the third pillar of the UNGPs. The UNGPs highlight that that ‘[e]ffective judicial mechanisms are at the core of ensuring access to remedy’ ⁸⁰ and that non-judicial remedies play a role in ‘complementing and supplementing judicial mechanisms’. ⁸¹ The evidence regarding practical, legal and financial barriers to remedy for victims of corporate human rights abuses are well documented. ⁸² Stakeholders in the EC study emphasized the need for any mHREDD duty to manifest itself as a civil remedy for victims. Moreover, the impact of the ability to seek judicial remedies extends beyond the ‘small handful’ of claims that are instituted, to ‘test the boundaries of the legal duty’ and ‘[o]ver time… build up clarity and anticipation’. ⁸³

The new EC Draft Directive introduces a statutory civil remedy for damages if companies fail to meet their relevant mHREDD duties. In many other non-EU jurisdictions, claimants have, at least in theory, the availability of civil remedies in tort law.

As mentioned above, ‘safe harbour’ exemptions can operate in a way that excludes a right to action where the statutory criteria have been met. (This is contrasted with the legal standard of care where the appropriateness and sufficiency of the company’s due diligence process is evaluated as part of the court enquiry.) For example, the kind of ‘safe harbour’ provisions like the one which was envisaged in the above-mentioned German Draft Key Points would actually remove access to existing civil remedies. Rights-holders wishing to access remedy would have been in a worse position than they would have been, had they still been able to rely on the existing tort law framework.

In the Schrems I case, the relevant Directive provided for independent, state-based supervisory authorities with ‘a wide range of powers’ including ‘investigative powers’, ‘effective powers of intervention, such as that of imposing a temporary or definitive ban on processing of data’ as well as ‘the power to engage in legal proceedings’. In addition to these powerful state-based bodies, the Court found in referring to Article 47 of the EU Charter of Fundamental Rights ⁸⁴ that: ⁸⁵

In a situation where the national supervisory authority comes to a conclusion that the arguments put forward in support of such a claim are unfounded and therefore rejects it, the person who lodged the claim must… have access to judicial remedies enabling him to challenge such a decision adversely affecting him before the national courts.

The Court also held that in the ‘converse situation’ where the supervisory authority agrees that the claimants’ rights may have been harmed, ‘it is incumbent on the national legislature to provide for legal remedies enabling the national supervisory authority concerned to put forward the objections which it considers well founded before the national courts’. ⁸⁶

It is clear from this dictum that even where a statute provides for a strong independent state-based complaints mechanism, claimants should still have access to judicial remedies before national courts.

IV. Conclusion

The concept of a ‘safe harbour’ has surfaced in several ongoing conversations around mHREDD regulations.

This article analysed situations in which the concept has been used to describe statutory conditions that, if met, limits or eliminates the ability to bring civil action against the company in court. In particular, three key examples of the use of the concept that are relevant in relation to the legislative developments on mHREDD were explored: the Barber case in relation to the California Supply Chain Transparency Act, the decision of the European Court of Justice in the Shrems I case, and the earlier German Draft Key Points which contained a safe harbour exemption.

In addition, the article outlines the differences between ‘safe harbour’ and how it differs from a ‘due diligence defence’ that is coupled with a legal standard of care. It also considered the ‘tick box’ approach as they relate to the ‘safe harbour’ approach.

Generally, a ‘safe harbour’ exemption could function to exclude access to court remedies, whereas the ‘due diligence defence’ refers to the defence that the company would have to mount in court by demonstrating that it has met a certain standard of care required by the law, on the specific facts of the case relating to the claimants. The court will assess the adequacy of the due diligence exercise on a case-by-case basis depending on the specific context, size, and risks of the company. In this way, the due diligence defence aligns with the concepts of HRDD set out in the UNGPs.

The concept of a ‘safe harbour’ in this context differs from, and in many ways contradicts the concept of a ‘due diligence defence’ for having undertaken HRDD as a legal standard of care. Nevertheless, these concepts are frequently used interchangeably within the discourse about the legislative design and implementation of mHREDD laws. It is preferable that the terminology of ‘safe harbour’ should not be used as a synonym for a ‘due diligence defence’, as this can be misleading and counter-productive to efforts towards achieving clear, coherent and effective legislation.