Corporate Social Responsibility and the Law

Advocates Seek Human Rights Commitments from Telecommunications Companies

saltschuller@foleyhoag.com (Sarah A. Altschuller) — Wed, 16 May 2012 18:48:55 -0500

Access, an advocacy organization that promotes open and secure access to the Internet, recently released its Telco Action Plan, a document that sets forth ten steps and implementation objectives for telecommunications companies (“telcos”) seeking to operate with respect for human rights.

Access launched the plan at last month’s Stockholm Internet Forum and intends to use the document as a platform for dialogue with telcos that seek to operate in political and legal contents that may post threats to freedom of expression, access to information, and/or privacy rights.

Building on an earlier 5-Step Action Plan, released in 2011, the new plan is informed by both the U.N. Guiding Principles on Human Rights and principles of the Global Network Initiative. Foley Hoag’s CSR practice provided input on the drafting of the 2012 plan.

Specifically, the Action Plan calls on companies to:

Operate in a manner that respects the fundamental human rights of all users, including the rights of freedom of expression, access to information, and privacy.
Seek to ensure that users’ access to telecommunications networks is maintained at all times.
Conduct ongoing due diligence on the human rights-related risks associated with their operations in consultation with local and international stakeholders, including independent human rights experts.
Integrate the findings from human rights due diligence efforts into the management of their operations in order to prevent adverse human rights impacts.
Requests from governments and partners to restrict users’ access, freedom of expression, or privacy should be presumptively rejected.
Insist that any restrictions on users’ rights strictly comply with international human rights laws and standards and the rule of law, and are necessary and proportionate to achieve a clearly defined and legitimate public purpose.
Be transparent with all stakeholders regarding current or likely restrictions on users’ access, freedom of expression, or privacy.
Engage in unilateral and multi-stakeholder dialogue, and advocacy as needed, with governments and business partners to ensure that users’ rights are protected at all times and to strictly limit the human rights-related risks associated with the provision of telecommunications services.
Ensure that all users have access to appropriate public and/or private remedies, including accessible grievance mechanisms, to seek redress in the event that restrictions are imposed on their fundamental human rights of freedom of expression, access to information, and privacy.
Submit to independent assessment of corporate activities and compliance with human rights standards, such as through the Global Network Initiative.

The plan then provides specific implementation guidance for companies on how to operate in a manner consistent with the ten steps noted above.

Telcos have faced increasing levels of scrutiny tied to their investments in countries where human rights protections may be weak, and their technologies and infrastructure may be used to support human rights abuses. During the uprisings in Middle East and North Africa over the last two years, companies have confronted public outcries as a result of their responses to government requests. As noted in a recent post, the White House recently issued an Executive Order imposing sanctions on information technology companies that facilitate human rights abuses in Iran and Syria.

Recently, a telecommunications industry dialogue has come together to discuss these concerns, especially those circumstances in which companies may be faced with government demands for user data and/or content restrictions. The new Action Plan is intended to inform these discussions and to encourage companies to be more transparent regarding their efforts to identify and mitigate the human rights-related risks of their operations.

Integration of ESG Factors into Private Equity Investment and Management Processes

saltschuller@foleyhoag.com (Sarah A. Altschuller) — Mon, 14 May 2012 10:39:37 -0500

Private equity firms are under increasing pressure, especially from their limited partners, to incorporate environmental, social, and governance ("ESG") factors into their investment and management processes. Limited partners expect private equity firms to integrate ESG criteria into due diligence practices, the management of existing portfolio companies, and communications to external stakeholders.

Many private equity firms have signed on to industry guidelines including the United Nations Principles for Responsible Investment (“UNPRI”) and/or the Private Equity Growth Capital Council’s Guidelines for Responsible Investment. Other firms have adopted their own policies. The UNPRI has a specific work stream on responsible investment and private equity and has published guidance for limited partners seeking to ensure that their general partners are working to identify and manage material ESG risks and opportunities associated with their potential and current portfolio companies.

In working with private equity clients, we have found the following steps to provide a useful framework for developing an approach to ESG considerations:

Adopting an ESG policy;
Formalizing firm-level ESG committees to develop the firm’s strategic approach to ESG factors;
Evaluating internal training needs and begin to provide training on specific ESG topics, as needed, to relevant personnel;
Developing tools and guidance to support the incorporation of ESG factors into due diligence on proposed investments;
Developing tools and guidance to support the incorporation of ESG factors into engagement with, and management of, portfolio companies; and
Developing strategies for communicating firm’s ESG initiatives to internal and external stakeholders.

As private equity firms begin to incorporate ESG concerns into due diligence processes for potential investments, ESG considerations may be formally incorporated into due diligence for all investments, or may be integrated into due diligence for a specific category of investments (i.e., investments of a certain size, or investments in particular sectors). Such efforts can be supported through materials and training that providing guidance on sector-specific concerns.

Private equity firms also have significant opportunities to integrate ESG factors into their management plans for portfolio companies. In their engagements with portfolio companies, firms can promote best practices, identify areas of concern, and monitor and track performance over time. Firms may engage directly with the CEOs and Boards of Directors of portfolio companies to identify ESG risks and opportunities that can be addressed during the term of the investment.

Finally, as private equity firms seek to demonstrate their efforts to limited partners and other stakeholders, it is useful to have established metrics that can be used to report on performance improvements and value creation both at the firm-level and by portfolio companies.

Integrating Corporate Social Responsibility into Corporate Compliance Programs

gjaramillo@foleyhoag.com (Gwendolyn Wilber Jaramillo) — Fri, 11 May 2012 11:18:15 -0500

Integrating corporate social responsibility ("CSR") into compliance structures and processes can be critical to ensuring a company’s CSR commitments are communicated and acted upon. Only then can a company reap the intended benefits of a voluntary commitment, whether those benefits are legal, reputational, or operational. Ideally, CSR should be integrated into training, learning, report, and auditing vertically and horizontally across a company.

In an article in the upcoming edition of Natural Gas & Electricity, I note that:

It is a mistake… to confuse the aspirational nature of many CSR commitments for unattainable goals, and a mistake to believe that those commitments cannot be broken down into concrete deliverables, procedures, and policies for use in achieving compliance. In fact, it is the process of converting a CSR standard into tangible goals with an aspirational context, and the dialogue and broad thinking that this process requires, which can be the driver of successful implementation of the standard.

In order to integrate aspirational commitments into concrete compliance targets, companies should establish what those commitments will require on a daily basis for the various business units and departments. In the article, I suggest that companies review the following steps as part of this exercise:

Articulate the standard.
Articulate the company commitment.
Identify existing complementary commitments or standards that may impact implementation.
Create a working group to identify operational goals.
Identify relationships (e.g., contractor, supplier, JV partner, host government) potentially impacted by implementation of standard.
Articulate operational goals for each commitment.
Identify sources of information regarding risks and sources of standards.
Identify key implementation steps for each standard.
Identify training, reporting and auditing requirements.
Identify Key Performance Indicators ("KPIs") for each standard (group by group as appropriate).

Ultimately, transforming aspirational commitments into concrete performance goals is fundamental to achieving real improvements in the company’s operations and the impacts of those operations on corporate stakeholders.

New Executive Order Imposes Sanctions on Technology Companies that Facilitate Human Rights Abuses in Iran and Syria

saltschuller@foleyhoag.com (Sarah A. Altschuller) — Tue, 01 May 2012 09:43:24 -0500

The White House recently released a new Executive Order imposing sanctions on information technology companies that facilitate certain human rights abuses in Iran and Syria. Released on April 23, the Executive Order ("Blocking the Property and Suspending the Entry into the United States of Persons with Respect to Grave Human Rights Abuses by the Governments of Iran and Syria via Information Technology") explicitly applies to both individuals and entities.

In the order, President Barack Obama states that

the commission of serious human rights abuses against the people of Iran and Syria by their governments, facilitated by computer and network disruption, monitoring, and tracking by those governments, and abetted by entities in Iran and Syria that are complicit in their governments’ malign use of technology for those purposes, threaten[s] the national security and foreign policy of the United States.

The order therefore imposes sanctions, including potential seizure of assets, on any individual or entity determined by the Secretary of the Treasury to have:

operated, or to have directed the operation of, information and communications technology that facilitates computer or network disruption, monitoring, or tracking that could assist in or enable serious human rights abuses by or on behalf of the Government of Iran or the Government of Syria.
sold, leased, or otherwise provided, directly or indirectly, goods, services, or technology to Iran or Syria likely to be used to facilitate computer or network disruption, monitoring, or tracking that could assist in or enable serious human rights abuses by or on behalf of the Government of Iran or the Government of Syria.

In recent months, U.S.-based companies have been named in the media as being involved in sales of technology to Iran and/or Syria, and reputational concerns and stakeholder advocacy have caused several companies to reevaluate their contracts. To date, however, no American companies have been named as sanctioned entities under the new Order, and it is unclear whether the Executive Order will be rigorously enforced. That said, all information technology companies are advised to evaluate the legal and reputational risks associated with the end-use of their products.

Companies should take specific note of two aspects of the new Order:

It covers indirect sales. Companies risk sanctions therefore if they sell certain technologies to third parties that subsequently use those technologies to facilitate human rights abuses in Iran or Syria.
It sanctions sales of goods, services and technologies that are “likely to be used” in a prohibited manner. This puts the burden on companies to evaluate their customers and the ways in which their products are likely to be used.

Companies are therefore advised to establish due diligence processes in order to assess the risks that their products will be used to facilitate the violation of human rights. If such risks as identified, companies should ensure that they have the policies and procedures necessary to avoid or mitigate potential adverse human rights impacts.

The Electronic Frontier Foundation, a nonprofit advocacy organization, recently released a report, Human Rights and Technology Sales: How Corporations Can Avoid Assisting Repressive Regimes, calling on companies to "know your customer." This requires establishing processes and procedures to identify and evaluate customers and potential sales.

As part of this due diligence, companies need to evaluate what legal protections exist in specific countries as well as the human rights records of customers and/or potential end-users. Companies should also seek to incorporate contractual provisions regarding the intended use of specific technologies. Ultimately, stakeholders and regulators will seek to hold companies accountable for the use of their technologies and it is therefore important for companies to evaluate their internal capacity to understand and manage the risks associated with certain sales.

U.S. Supreme Court Holds that the TVPA Does Not Apply to Organizations, but Corporate Officers Are Still Fair Game

ameisebay@foleyhoag.com (Xander Meise Bay) — Mon, 23 Apr 2012 21:17:22 -0500

Renewing speculation about the future of corporate liability for human rights abuses, last week the Supreme Court held unanimously in Mohamad v. Palestinian Authority that the Torture Victims Protection Act (“TVPA") cannot be used to sue organizations, and by extension, corporations. The Court, however, did not limit the type of individuals subject to suit under the Act, thus a corporation’s officers or employees may still find themselves open to suit under the TVPA.

The Mohamad petitioners were representatives of the estate of Azzam Rahim, an American citizen who was tortured and killed overseas while in the custody of Palestinian Authority intelligence officers. Asserting claims of torture and extrajudicial killing, petitioners used the TVPA to sue both the Palestinian Authority and the Palestine Liberation Organization, arguing that Congress’s use of the word “individual” in the TVPA showed that it had contemplated that the Act could be used to sue both “nonsovereign organizations” and natural persons.

Rejecting this argument, the Court explained that Congress’s use of “individual” in the Act in fact demonstrated its intention to limit the TVPA’s application to permit suits only against “natural persons” (i.e., human beings).

Under the TVPA:

An individual who, under actual or apparent authority, or color of law, of any foreign nation –

(1) Subjects an individual to torture shall, in a civil action, be liable for damages to that individual; or

(2) Subjects an individual to extrajudicial killing shall, in a civil action, be liable for damages to the individual’s legal representative, or to any person who may be a claimant in an action for wrongful death.

Taking a highly textual approach to its analysis of this provision, the Court emphasized the importance of the ordinary meaning of “individual,” as well as the word’s statutory context:

The [TVPA’s] liability provision uses the word ‘individual’ five times in the same sentence: once to refer to the perpetrator (i.e., the defendant) and four times to refer to the victim. … Only a natural person can be a victim of torture or extrajudicial killing. ‘Since there is a presumption that a given term is used to mean the same thing throughout a statute,’ … it is difficult indeed to conclude that Congress employed the term ‘individual’ four times in one sentence to refer to a natural person and once to refer to a natural person and any nonsovereign organization.

Although the “natural person” interpretation of “individual” here puts an end to TVPA suits against corporations or legal persons, it certainly still permits TVPA suits against individuals such as corporate officers, directors, or employees.

In addition, despite the bold headlines inspired by the ruling, Mohamad does not provide much insight into how the Court might rule this fall in Kiobel v. Royal Dutch Petroleum, where the Court is expected to address whether corporations may be held liable under the Alien Tort Statute ("ATS") and whether the ATS may be applied extraterritorially. Mohamad was argued the same day as Kiobel and the TVPA and the ATS have historical and legal links, but the Court mentioned Kiobel only once in Mohamad, and even then it did so only to contrast the language of the ATS with that of the TVPA.

Specifically, the Court noted that “regardless of whether corporate entities can be held liable in a federal common-law action brought under [the ATS]” (as questioned in Kiobel), the ATS “offers no comparative value” for interpreting the TVPA’s use of “individual” because nowhere in the ATS is “individual” used to describe potential defendants. This observation should mean that the holding that the TVPA does not apply to corporations is equally of “no comparative value” to the Court’s future analysis of the applicability of the ATS to corporations.

Mohamad may have freed corporate entities from TVPA suits, but until the Supreme Court issues its ruling in Kiobel, they remain potentially liable under the ATS. Furthermore, human individuals, such as corporate officers and employees, remain open to suit under both statutes.

Assessing Corporate Policies and Procedures to Protect Freedom of Expression and Privacy Rights

saltschuller@foleyhoag.com (Sarah A. Altschuller) — Wed, 18 Apr 2012 12:48:20 -0500

What policies, processes, and procedures do companies need to have in place in order to protect the fundamental human rights of freedom of expression and privacy?

This question was central to the first independent assessments of corporate implementation of the Global Network Initiative ("GNI") Principles, conducted this past year and announced on April 18 with the release of GNI's second annual report.

Foley Hoag is very pleased to have been selected as one of the three assessors for this first round of independent assessments, which focused on the three founding GNI companies - Google, Microsoft, and Yahoo!.

At the time of the GNI report's release, Arvind Ganesan, GNI Board Member and Director of Business and Human Rights at Human Rights Watch, observed,

Balancing rights to free expression and privacy with government requests is no easy task for ICT companies. These assessments are an important milestone demonstrating the value of a collaborative, but rigorous approach.

The independent assessments focused on each company's policies, processes, and procedures to protect freedom of expression and privacy rights, with specific focus on the following issues:

Responsible Company Decision-Making

Board review, oversight, and leadership - To what extent does the Board of Directors review the impact of the company's operations on freedom of expression and privacy?
Human rights impact assessments - How does the company utilize human rights impact assessments to identify circumstances in which freedom of expression and/or privacy rights might be jeopardized?
Partners, suppliers, distributors - How does the company seek to ensure that its partners, suppliers, and distributors operate in a manner consistent with the Principles?

Integration into Business Operations

Structure - What internal structures help ensure that the company's commitments are integrated into its decision-making and operations?
Procedures - What procedures help ensure consistent implementation of corporate policies intended to protect freedom of expression and privacy?
Employees - How does the company communicate its commitments to employees?
Complaints and assistance - Does the company have grievance procedures to response to employees and other stakeholders can raise concerns about the company's implementation of the GNI Principles?

Freedom of Expression

Government demands, laws, and regulations - What policies and procedures guide the company's response to government demands, laws, and regulations that might infringe on users' freedom of expression rights?
Communication with users - How does the company communicate with users regarding its policies and procedures for responding to government demands to remove or limit access to content or to restrict communications? How does the company disclose to users when content has been restricted or blocked by the company in response to government restrictions?

Privacy

Data collection - How does the company assess the human rights risks associated with the collection, storage, and retention of users' personal information in the jurisdictions in which it operates?
Government demands, laws, and regulations - What policies and procedures guide the company's response to government demands, laws, and regulations that might infringe on users' privacy rights?
Communication with users - How does the company communicate to users what personal information it collects? How does the company communicate to users its procedures for responding to government demands for users' personal information?

These questions, central to the GNI's implementation guidelines, reflect the fundamental importance of supporting a company's external commitments with strong internal management systems.

Ultimately, there is no "one size fits all" approach to managing these issues responsibly. Each company must assess the specific risks associated with its activities and determine how best to avoid, mitigate, and manage those risks in the context of its own internal structures, its external relationships, and the nature and location of its operations.

The GNI Principles allow for this flexibility. As Susan Morgan, Executive Director of GNI, observed in conjunction with the report's release, "[e]ach company is taking its own approach to implementation and we’re starting to see some different examples of how the companies are meeting their commitments."

Through our own involvement in the assessment process, it was clear that each of the three companies involved faced different challenges and that addressing these challenges effectively required approaches that were both specific to each company's internal management systems and guided by commitments to internationally-recognized human rights.

United States Eases Sanctions on Financing for Development Organizations in Burma

alehr@foleyhoag.com (Amy K. Lehr) — Tue, 17 Apr 2012 16:03:32 -0500

On April 17, the U.S. Treasury issued new General License No. 14-C, which relaxes sanctions on financial services with respect to certain humanitarian and not-for-profit activities in Burma.

This License allows financial services to support a broader range of development projects than was previously permitted, and includes: (1) projects to meet basic human needs; (2) democracy building and good governance projects; (3) educational activities; (4) sporting activities; (5) non-commercial development projects directly benefiting the Burmese people; and (6) religious activities.

The License implements Secretary of State Hillary Clinton’s April 4 statement that the United States would begin to ease sanctions on the long-isolated country. Secretary Clinton indicated that the United States will also relax restrictions on some business activities in Burma, but it is still unclear how the United States will implement this policy.

The new License means that Burma, long starved of aid money, will experience an increase in the presence of international non-governmental organizations. Presumably, some of the financing will also flow to local not-for-profits, which have been growing in number in recent years. Burma ranks the lowest of any mainland East Asian country on the U.N.’s Human Development Index, so there is clearly an opportunity to make a difference.

The extent to which development organizations have a positive impact will depend in part on the extent to which they obtain access to conflict areas; the capacity of the government to work with international civil society organizations; and the ability of organizations to hire well-trained local staff, given that Burma’s universities were closed for many years. Additionally, although not-for-profits’ programs certainly have the ability to improve development indicators, a report by the Project 2049 Institute outlines the risk that aid organizations will accidentally foster conflict in Burma, and lays out parameters to help donors and development groups avoid such unintended consequences.

Floating the Kyat: A First Step in Fighting Corruption in Burma

alehr@foleyhoag.com (Amy K. Lehr) — Thu, 12 Apr 2012 16:05:04 -0500

On April 2, one day after its Parliamentary by-elections, Burma (Myanmar) floated its currency, the kyat. This is an important first step in normalizing the country’s investment climate and curbing corruption. For years, the official kyat exchange rate has been more than 100 times lower than the black market rate, which has led to endless headaches for organizations operating in Burma, as well as for Burmese citizens.

The distortion of the kyat also made it easier to hide corruption. According to Sean Turnell, a leading expert on the Burmese economy, officials recorded revenues at the official exchange rate -- which undervalued them by nearly 200 percent when the black market exchange rate is taken into account -- and spirited away the remainder.

Floating the kyat will slightly enhance transparency, and will decrease the everyday annoyance of conducting business in Burma, but more reforms are needed to address corruption. Transparency International ranks Burma as one of the most corrupt countries in the world, followed only by North Korea and Somalia.

Such corruption certainly affects the business community. A local newspaper recently reported evidence of corruption in six key ministries, including in relation to the awarding of a valuable copper mine concession. Corruption extends well beyond business into many aspects of society, with payments routinely required to obtain passports, good grades, or government jobs. These are minor symptoms of a culture of corruption that has become endemic and will take significant efforts to address.

The Burmese government has begun to publicly acknowledge the prevalence of corruption and the need to address it, but the formula to do so is not clear. A senior Burmese government official noted that petty corruption arises in part due to the gross underpayment of civil servants, which has made it challenging for many to survive without engaging in corrupt practices. One of President Thein Sein’s economic advisors added that it will take time to implement fundamental changes that diminish corruption, and highlighted the fact that powerful interests are likely to resist reforms.

In a classic twelve-step self-help program, recognition of the problem is a first step toward solving it. Floating the kyat may actually be step two therefore, with the government’s public statements identifying corruption as a significant problem constituting step one. While the government continues -- hopefully -- through steps 3-12, companies and non-governmental organizations that operate in Burma will face significant risks, including potential liability pursuant to the U.S. Foreign Corrupt Practices Act and/or the U.K. Bribery Act, and they should plan accordingly.

For instance, companies that purchase the assets or operations of other businesses should seek to ensure that such rights were not originally obtained fraudulently and should analyze the reputations of their business partners by not only reviewing relevant legal documents, but also by talking to knowledgeable Burmese. Companies should also emphasize their anti-corruption commitments to local employees or contractors and make it clear that business as usual is not acceptable.

Would the End of the Alien Tort Statute Mean an End to Corporate Liability for Human Rights Abuses?

ameisebay@foleyhoag.com (Xander Meise Bay) — Tue, 10 Apr 2012 15:18:14 -0500

If the U.S. Supreme Court strikes down, or severely limits, the Alien Tort Statute (“ATS”), what are the implications for plaintiffs and defendants in cases involving violations of international human rights law? The crystal balls were out in Washington recently as scholars and practitioners alike continued to speculate about the future of the ATS following the Supreme Court’s order to rehear arguments in Kiobel v. Royal Dutch Petroleum.

In Kiobel, the Supreme Court could hold that the ATS has no extraterritorial application, it could severely limit its application, or it could maintain the status quo. Many have wondered if a Supreme Court ruling against the extraterritorial application of the ATS would put an end to suits against corporations for human rights abuses committed outside of the United States, but the emerging consensus is that even without the ATS, potential plaintiffs will have the capacity to submit their claims to other local or international tribunals.

The most viable option for potential plaintiffs would be to pursue tort claims in local courts in the jurisdiction where the alleged torts occurred. The applicable local laws would dictate the nature and scope of these suits. If the local laws do not distinguish between natural and legal persons, it is possible that they would provide for corporate liability or individual corporate director liability for the acts of corporations. In addition, countries such as Germany, Sweden, and Mexico are willing to impose fines or sanctions on corporations for some international human rights violations, even if they are not willing to hold corporations, who are only “legal persons,” directly liable for criminal acts.

Second, these cases could end up in the jurisdiction where the potential defendants reside or conduct their primary business activities, or in locations exercising universal jurisdiction or applying common law principles to bring civil or criminal charges. Plaintiffs have already brought such suits to varying levels of success. For example, in Yao Essaie Motto and others v. Trafigura Ltd & Anor, a British subsidiary of a Dutch company faced charges in London, where its operations center was located, concerning the illegal disposal of hazardous waste in Ivory Coast by one of the parent company’s ships. The Trafigura case was settled shortly before oral argument at the High Court for around £28 million, but the underlying incident also set off civil and criminal litigation in other jurisdictions including Ivory Coast (where the alleged tort occurred) and the Netherlands (where the parent company was incorporated), where cases resulted in sentences for some individuals and total corporate and individual fines in excess of EUR 1 million.

Cases such as Trafigura demonstrate the willingness of some States to extend their jurisdictional reach in the context of human rights violations or other series crimes. Even if the ATS option is lost, the international community has already been addressing these issues through new legislation and other measures. For example, with the Canadian Parliament’s adoption of Justice for Victims of Terrorism Act in March, Canada has joined those States permitting the use of their domestic courts to litigate violations of international human rights law, specifically in cases involving alleged acts of terrorism. This Act creates a cause of action for damages or losses related to terrorist acts even if they occur outside of Canada to non-Canadian citizens, subject to certain conditions. On the other side of the Atlantic, national courts within the European Union are already authorized to exercise jurisdiction over any defendant corporation that is an EU domiciliary, subject to certain conditions, even if the acts alleged at suit occurred elsewhere.

Given alternative court options emerging outside of the United States, even if the Supreme Court were to hold that the ATS no longer applies extraterritorially, corporations could still find themselves in lengthy litigations over alleged human rights abuses committed in third-countries. Ultimately, an end to the ATS is not necessarily an end to corporate liability.

Fools Rush In: Social and Environmental Due Diligence in Burma

alehr@foleyhoag.com (Amy K. Lehr) — Wed, 04 Apr 2012 16:46:10 -0500

Following the success of Daw Aung San Suu Kyi and her National League for Democracy (“NLD”) party at the polls and today's announcement that the United States will soon lift some of its sanctions against Burma, companies are closely scrutinizing the possibility of conducting business in the long-isolated country.

Recent events should not, however, be considered a green light to conduct business in Burma for at least two reasons:

First, governments are likely to take a step-by-step approach to the sanctions, awarding Burma for specific actions taken, rather than lifting them wholesale.
Second, even if all the sanctions were lifted tomorrow, companies would be wise to proceed with great caution and conduct robust, project-specific social and environmental due diligence.

In a statement issued earlier today, U.S. Secretary of State Hillary Clinton announced that the United States will lift sanctions related to international development aid and some travel restrictions and will begin

the process of a targeted easing of [the] ban on the export of U.S. financial services and investment as part of a broader effort to help accelerate economic modernization and political reform.

Today's announcement signals impending change in U.S. sanctions policy, but should not be understood to mean that the U.S. government will lift all or most investment-related sanctions in the immediate future. Rather, the Obama Administration has noted that it will lift sanctions in a stepwise process if Burma takes more actions to demonstrate that it is moving toward a democratic system.

The Obama Administration and Congress will condition the further lifting of sanctions on whether Suu Kyi comments positively on the elections; her party’s ability to operate freely in the Parliament and institutionalize rule of law; and whether Burma makes progress on resolving the myriad ethnic conflicts along its borders. How, exactly, improvement in these areas will be measured is not clear, but Burma is unlikely to make substantial progress on them overnight, meaning that it will take time for the sanctions to be lifted. Furthermore, Congress and the Obama Administration may hold different views on what constitutes sufficient progress, which will slow the lifting of sanctions because the process requires coordination between the two branches of government.

In the meanwhile, companies should consider how they would conduct business responsibly in Burma, were the investment-related sanctions to be lifted. Widespread corruption, ethnic conflict, and antiquated social and environmental regulations present significant challenges. Companies will need to conduct robust social and environmental due diligence that takes into account the specific industry and location -- general country due diligence will not suffice.

Context matters enormously. For instance, infrastructure projects even in central Burma raise significant human rights concerns, given the Burmese government’s resettlement practices, but infrastructure projects in ethnic regions are even more problematic. The central government is disliked and has limited control in ethnic areas, and companies should not assume that a government permit provides a social license to operate. Companies that seek to operate in ethnic areas should consider the risk that they will exacerbate conflict between ethnic groups and the central government -- a determination that requires detailed due diligence, taking into account the specific ethnic groups involved.

In instances in which investments would not have a large physical footprint, companies should still exercise caution. Corruption is a significant problem, and the military and its affiliates play an outsized role in the economy. Even if local companies are not on sanctions lists, they may be associated with notorious military officers who are linked to human rights abuses. Accordingly, conducting business with such companies, even if legal, could have negative reputational effects. Projects in Burma face other challenges as well because Burma inadequately regulates labor rights, privacy, freedom of expression, and the environment, so companies that merely follow national law would fall well below international standards for good practice.

In short, the United States will lift some sanctions on Burma in the near future, but will not end most related to investment for some time. This provides an opportunity for responsible companies to consider what forms of due diligence they would carry out so that their investments do not have negative social or human impacts, and do not bring excessive corruption risks. Companies should become familiar with Burma’s complex political and ethnic make-up so that if the investment-related sanctions are lifted, they are prepared to conduct due diligence that is granular and specific to avoid the myriad pitfalls related to operating in Burma.

Afghanistan's Ban on Private Security Companies: What are the Risks for Private Investors?

eholland@foleyhoag.com (Elizabeth Holland) — Mon, 02 Apr 2012 18:19:25 -0500

The month of March marked a key deadline in the compulsory -- but gradual -- transition from the use of private to public security forces in Afghanistan. This transition was initiated in August 2010 when President Hamid Karzai issued Presidential Decree 62 in response to a number of criticisms regarding the presence, role and activities of private security companies ("PSCs") in Afghanistan. With a few exceptions, the Decree called for all private security companies (including Afghan-owned or run PSCs) to be disbanded by March 2012.

Current and Future Security Needs -- and Associated Risks

Though government programming and development operations may be most affected by this development right now, Afghanistan’s untapped mineral deposits, reportedly worth close to USD $1 trillion, are attracting significant attention from private investors. It appears likely that mining operations will expand considerably in the coming years, and this operations will require security.

Companies seeking to operate in Afghanistan are well-advised to pay close attention to the vetting, training, and conduct of the security forces forces with which they enter into contracts. In remarks delivered at a July 2010 Extraordinary Plenary Meeting of the Initiative of the Voluntary Principles on Security and Human Rights, a tri-partite multi-stakeholder initiative, John Ruggie, the former U.N. Special Representative for Business and Human Rights, observed that,

the worst forms of corporate-related human rights abuse take place in conflict or otherwise stressed governance zones. They account for the largest number of foreign direct liability claims against multinational companies...brought in domestic courts but often invoking international standards.

The Special Representative also observed that companies operating in areas of conflict "increasingly suffer significant financial costs as a result of stakeholder-related risks to their operations—which in turn reflect push-back by communities for harms they associate with company activities." In this context, companies seeking to operate in Afghanistan face considerable security challenges, and associated legal, reputational, and operational risks.

Seeking Commitments from Security Providers in Afghanistan

At this time, the Afghan Public Protection Force (APPF) is currently slated to fill the security void created by the ban on PSCs. The APPF is a pay-for-service security provider operated under the Afghan Ministry of the Interior. It is a state-owned enterprise, allowing it to contract with both domestic and international customers.

The APPF has made available on its website its Contract Template that includes an Annex entitled “Code of Conduct Implementing Document.” Referencing international law, domestic law, the Montreux Document on Private Military and Security Companies, and the Respect, Protect, Remedy Framework, the Annex notes that the APPF commits to operating in accordance with Afghan laws and regulations as well as relevant corporate standards of business conduct. Further, it commits to operating in a manner that recognizes and supports the rule of law, respects human rights and protects clients’ interests.

Even with these stated commitments, companies contracting with the APPF should carefully consider their individual exposure to security and human rights-related risks. Companies entering into contracts for security should carefully consider the potential risks associated with such contracts and the extent to which both voluntary guidelines, such as the Voluntary Principles on Security and Human Rights, and negotiated commitments on oversight and training can help mitigate and/or avoid certain security-related risks.

Notably, the passage of the March 2012 deadline, however, does not mean that all PSCs have left Afghanistan. The Decree provided for the establishment of risk management companies ("RMCs"). These companies, once licensed by the APPF, may operate in-country to provide services restricted to “security advice and expertise.” To date, a number of PSCs have already established RMCs.

Looking ahead, it is reported that Iraq is considering a similar ban on private security companies, a development which will significantly impact a number of companies already operating in the country. At this time, it remains to be seen whether the approach adopted by the Iraq government will resemble that in effect in Afghanistan.

FTC Releases Final Report: "Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers"

saltschuller@foleyhoag.com (Sarah A. Altschuller) — Tue, 27 Mar 2012 22:28:00 -0500

This post, written by Colin J. Zick, was originally posted on Foley Hoag's Security, Privacy and the Law blog.

* * * * *

FTC has released the final version of its original 2010 Report — "Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers." As we have discussed previously, comments on the draft report were taken through January 31, 2011 and the final report had been expected in 2011.

The FTC received over 450 comments from businesses, privacy advocates, and consumers and claims that the final Report retains the basic principles outlined previously, but claiming it makes several important refinements. There's also a brief new video explaining the FTC's positions. Here are the key take-aways from the final report:

Privacy by Design. Companies should build privacy protections into their everyday business practices. That includes limiting data collection and retention, securing the information they hold on to, safely disposing of what they no longer need, and implementing reasonable measures to ensure information is accurate.
Simplified Choice. Companies should give consumers a choice at a time and in a context that matters to people. The preliminary report noted that choice shouldn’t be necessary for certain “commonly accepted practices.” The final Report concludes that choice needn’t be provided for data practices that people would expect, given the context of the transaction, the company’s relationship with the consumer, or as required or specifically authorized by law.
Do Not Track. The Report also reaffirms the Commission’s strong support for Do Not Track.
Improved Transparency. Companies should increase the transparency of their data practices by developing clearer, more standardized privacy disclosures and could give people reasonable access to their information.
Exemption of Small Businesses. To minimize the effect on smaller companies, the final framework doesn’t apply to them if they collect only non-sensitive data from fewer than 5,000 consumers a year, provided they don’t share the data with third parties.

Most interesting to me is the Dissenting Statement of Commissioner J. Thomas Rosch, in which he makes several interesting points:

"First, the Report is rooted in its insistence that the “unfair” prong, rather than the “deceptive” prong, of the Commission’s Section 5 consumer protection statute, should govern information gathering practices (including “tracking”). “Unfairness” is an elastic and elusive concept. What is “unfair” is in the eye of the beholder."
"Second, the current self-regulation and browser mechanisms for implementing Do Not Track solutions may have advanced since the issuance of the preliminary staff Report" and the Report does not adequately take account of this change.
"I am concerned that "opt-in” will necessarily be selected as the de facto method of consumer choice for a wide swath of entities that have a first-party relationship with consumers but who can potentially track consumers’ activities across unrelated websites, under circumstances where it is unlikely, because of the “context” (which is undefined) for such tracking to be “consistent” (which is undefined) with that first-party relationship: 1) companies with multiple lines of business that allow data collection in different contexts (such as Google); 2) “social networks,” (such as Facebook and Twitter), which could potentially use “cookies,” “plug-ins,” applications, or other mechanisms to track a consumer’s activities across the Internet; and 3) “retargeters,” (such as Amazon or Pacers), which include a retailer who delivers an ad on a third-party website based on the consumer’s previous activity on the retailer’s website.
"I question the Report’s apparent mandate that ISPs, with respect to uses of deep packet inspection, be required to use opt-in choice."

Consumer Privacy - Thoughts on the Obama Administration's New "Bill of Rights"

cdonovan@foleyhoag.com (Caroline Donovan) — Thu, 15 Mar 2012 05:09:16 -0500

The Obama Administration’s release last month of a framework for protecting online privacy ranks among the most significant efforts to address privacy concerns in the short history of the information age.

The framework’s centerpiece is a “Consumer Privacy Bill of Rights” (.pdf). As discussed on Foley Hoag's Security, Privacy, and the Law blog, the Bill of Rights articulates seven broad, flexible, and forward-looking principles that should be able to accommodate the ever-changing nature of online privacy challenges:

Individual Control: Consumers have a right to exercise control over what personal data companies collect from them and how they use it.
Transparency: Consumers have a right to easily understandable and accessible information about privacy and security practices.
Respect for Context: Consumers have a right to expect that companies will collect, use, and disclose personal data in ways that are consistent with the context in which consumers provide the data.
Security: Consumers have a right to secure and responsible handling of personal data.
Access and Accuracy: Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data is inaccurate.
Focused Collection: Consumers have a right to reasonable limits on the personal data that companies collect and retain.
Accountability: Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights.

The Administration gets a lot right in its framework. It recognized the need for its leadership in brokering a privacy deal between Internet businesses and consumer privacy advocates, and it responded with a broad framework that benefited both. Consumers obtain greater privacy protections, while companies derive a clear and consistent understanding of consumer expectations, the respect of which engenders consumer trust required to promote the growth of Internet companies.

The Bill of Rights requires a close connection between the reason for data’s collection and its ultimate use—and when that connection is not there, it requires transparency so that a consumer can control that use. As a set of values to be promoted across industry privacy efforts, the Bill of Rights is a resource for companies as much as a source of rights for consumers.

The second plank in the Administration’s framework melds self-regulation with government regulation by calling upon the Department of Commerce to spearhead a multi-stakeholder process to develop issue- and industry-specific codes of conduct. While participation in the codes of conduct is entirely voluntary, the codes will be enforceable by the Federal Trade Commission under its authority to prevent deceptive acts and practices. It remains to be seen just how many companies will be willing to sign up for this hybrid approach to regulation.

The wider framework includes other planks that vary greatly in quality and utility. The Administration’s call on Congress to enact legislation codifying the principles embedded in the Bill of Rights and expanding upon them with content derived from the individual codes of conduct sounds like a good idea in principle, but it runs the risk of freezing what are meant to be constantly evolving codes as of the moment the law is enacted. Given that partisan gridlock in Washington appears to be here to stay, the flexible approach to regulating online privacy embodied in the Bill of Rights seems better suited to keeping regulation up to date with the unremitting pace of online innovation.

The Conflict Minerals Rule - Phantom or Final?

alehr@foleyhoag.com (Amy K. Lehr) — Fri, 09 Mar 2012 04:38:20 -0500

A recent letter from Senator Patrick Leahy (D-VT) created expectations that the U.S. Securities and Exchange Commission (“SEC”) had drafted and circulated its long-awaited final rule on conflict minerals. These expectations now seem to have been premature.

In mid-February, Senator Leahy and other co-sponsors of the conflict minerals provision -- Section 1502 of the Dodd-Frank Wall Street Reform and Consumer Protection Act -- sent a letter to the SEC (.pdf) that was interpreted to imply that the SEC had drafted a final rule and shared it with lawmakers, which caused a flurry of speculation regarding the content and timing of the final rule.

The letter addressed a number of substantive issues, arguing that the final rule should not allow companies to state that their due diligence findings were “indeterminate” and requesting that the Conflict Minerals Report that some companies will be required to produce be filed, not furnished, as part of the companies’ SEC annual reports. It was assumed that the Senators were writing after reviewing a copy of a final rule.

The SEC has since stated that it has not produced a final conflict minerals regulation, nor has it shared such a document with any lawmakers. It is possible that Senator Leahy’s letter was simply addressing concepts that the Senators thought might be included in the draft rule.

Speculation regarding what the Senators saw – if anything -- will doubtless continue, but it is unlikely that a final conflict minerals rule will be immediately forthcoming. In early March, SEC Chairman Mary Schapiro stated that she was hopeful that the rule would be finalized in the "next couple of months." Notably, she indicated that there will be a "phase-in" period for the regulations. Specifically, Chairman Schapiro stated,

We will have a phase-in period, I don't know how long, that will... give sufficient time for some of the supply chain due diligence mechanisms to be developed and put in place.

As we noted in a previous post, the final rule was originally scheduled to be issued no later than April 15, 2011, but the SEC has postponed issuing its final rule several times.

A Surprise Twist: U.S. Supreme Court Will Rehear Kiobel

saltschuller@foleyhoag.com (Sarah A. Altschuller) — Mon, 05 Mar 2012 23:23:22 -0500

On March 5, less than a week after oral arguments in Kiobel v. Royal Dutch Petroleum, the Supreme Court ordered the case "restored to the calendar for reargument." The Court's order directed the parties to file new briefs on a calendar running through June 29. The case will not be decided this term.

The Court's order directs the parties to focus their briefs on the following question:

Whether and under what circumstances the Alien Tort Statute, 28 U.S.C. §1350, allows courts to recognize a cause of action for violations of the law of nations occurring within the territory of a sovereign other than the United States.

Compare this question with the questions that were before the Court in its initial review of the case:

Whether the issue of corporate civil tort liability under the Alien Tort Statute ("ATS"), 28 U.S.C. § 1350, is a merits question, as it has been treated by all courts prior to the decision below, or an issue of subject matter jurisdiction, as the court of appeals held for the first time.

Whether corporations are immune from tort liability for violations of the law of nations such as torture, extrajudicial executions or genocide, as the court of appeals decisions provides, or if corporations may be sued in the same manner as any other private party defendant under the ATS for such egregious violations, as the Eleventh Circuit has explicitly held.

Leading up to last week's oral arguments, the attention of most observers had been focused on the question of whether companies are proper defendants in ATS cases. Now, the Court has refocused its review of the case on the issue of extraterritoriality. As noted in our initial review of last week's arguments, several Justices focused on the extraterritoriality in their questions to petitioners' counsel.

As several commentators have observed, the Court's decision to rehear Kiobel comes immediately after its review of whether to grant a writ of certiorari in Sarei v. Rio Tinto, a Ninth Circuit case in which questions of extraterritoriality have been a central issue. While the Court has not announced a decision on whether it will review Sarei, by issuing an order for rehearing in Kiobel, the Court has made clear that it will address the extraterritoriality issues at stake in ATS jurisprudence.

While the Ninth Circuit's most recent decision in Sarei was most notable in that it upheld corporate liability under the ATS, court observers may remember the vigorous dissent by Judge Kleinfeld to the en banc Court's November 2010 order referring the case to mediation. In that dissent, Judge Kleinfeld stated that,

We have not yet decided whether we have jurisdiction over this dispute. I very much doubt that we do. I suspect that we lack jurisdiction both because the case involves a political question and because we lack subject matter jurisdiction on account of extraterritoriality. This case is entirely extraterritorial. The claims are by Papua New Guineans against a BritishAustralian company for wrongs committed in Papua New Guinea. Although Rio Tinto has operations in many countries, including the United States, and Sarei lived in the United States as a resident alien when the complaint was filed, nothing done by Americans or in America, is at issue.

Judge Kleinfeld then suggested that "the point of the ATS was to keep us out of international disputes, not to inject us into them."

In last week's hearing, Justice Alito observed that Kiobel involved Nigerian plaintiffs alleging violations of international law in Nigeria. He then questioned, "What business does a case like that have in the courts of the United States?" Judge Kleinfeld's dissent takes on new relevance now that the Supreme Court's express intent in reviewing Kiobel has shifted.

U.S. Supreme Court Review of Corporate Liability Under the Alien Tort Statute -- An Overview of the Oral Arguments in Kiobel v. Royal Dutch Petroleum

saltschuller@foleyhoag.com (Sarah A. Altschuller) — Tue, 28 Feb 2012 23:26:36 -0500

On February 28, in proceedings that were both closely watched and anxiously anticipated, the U.S. Supreme Court heard oral arguments in Kiobel v. Royal Dutch Petroleum. For the first time, the question of whether corporations are proper defendants in Alien Tort Statute ("ATS") cases is squarely before the Court. Petitioners had sought Supreme Court review of a decision by the Second Circuit Court of Appeals finding that corporations are not proper defendants under the ATS.

Corporate Liability: Defined by International Law or a Question of Domestic Enforcement?

A preliminary transcript of the oral arguments is available here (.pdf). The transcript reflects that, on several fundamental points, Petitioners' counsel, Paul Hoffman, faced a skeptical bench. The hearing had barely begun when Justice Kennedy challenged Mr. Hoffman with the argument that "international law does not explicitly recognize corporate responsibility for the alleged offenses."

Justice Kennedy's opening challenge encapsulates the fundamental question at issue in this case: must international law explicitly provide for corporate liability in order for corporations to be proper ATS defendants, or is the question of corporate liability a question of enforcement (or remedy) that can be properly decided by domestic courts?

The Court was clearly split on this question. At one point, Justice Kagan asserted that "the question of who can be sued is a remedial question." In contrast, Chief Justice Roberts stated that "under international law, it is critically important who's undertaking the conduct that is alleged to violate international norms."

Concerns About Extraterritoriality

Several Justices raised questions that focused on the extraterritorial nature of the ATS, despite the fact that this issue was not directly before the Court and had not been fully briefed. After noting that Kiobel involved Nigerian plaintiffs alleging violations of international law in Nigeria, Justice Alito bluntly challenged Mr. Hoffman with the question - "What business does a case like that have in the courts of the United States?"

The ATS Stands Alone

Also at issue was the fundamental uniqueness of the ATS. Chief Justice Roberts, Justice Kennedy, and Justice Alito each questioned whether there was any other country in the world where such a suit could be brought. In contrast, Justice Kagan seemed less uncomfortable with the singular nature of the statute, observing that "[t]he ATS is just a unique statute. It's unique against individuals, and it's unique against corporations."

U.S. Support for Petitioners' Arguments on Corporate Liability

Petitioners were supported by the United States, appearing as amicus curiae. Counsel for the United States, Edwin Kneedler, argued that "international law norms proscribe certain conduct" but enforcement "is left to each nation." He urged the Court to focus on the fact that the ATS is explicitly about tort, stating that this "directs the Court to domestic tort law, and the question of whether a corporation can be held liable under domestic tort law." Mr. Kneedler argued that a corporation "clearly can be" held liable under domestic tort law, stating that "[i]t could be at the time this statute was enacted, and it can be today."

Respondents: International Law Does Not Support Corporate Liability

In representing Respondents, Kathleen M. Sullivan was unyielding in her argument that there is no source of customary international law "throughout the world that holds corporations liable for the types of human rights offenses" at issue in Kiobel. She argued that "the law of nations is uniform. It rejects corporate liability." Justice Kagan directly challenged this assertion, stating that "as far as I can see, the international sources are simply silent as to this question."

Pirates, Inc. and Hypothetical Norwegians Operating with Impunity

In challenging the arguments of Respondents, several Justices seemed troubled by the potential implications of a complete rejection of corporate liability. Justice Breyer raised the hypothetical of "Pirates, Inc." Noting that an individual pirate could held be liable under the ATS for acts of piracy, Justice Breyer questioned whether the hypothetical corporation "Pirates, Inc." would nevertheless be free from liability for those same acts. Ms. Sullivan declared quite definitively that "the corporation would not be liable."

In questioning Ms. Sullivan, Justice Kagan observed that various treaties and international conventions "prohibit certain acts, [but] don't talk about the actors." Justice Kagan raised the prospect of a hypothetical defendant arguing that a specific norm of international law does not apply to Norwegians because there is no international jurisprudence specifically about the liability of Norwegians, nor is there a specific reference to Norwegians in the norm at issue. Justice Kagan concluded that "of course" an international law norm would apply to Norwegians, "because it prevents everybody from committing a certain type of act."

Kiobel in Context -- A World Away from 2004

In reviewing the hearing, and the potential implications of the Court's future decision, it is notable that many of the recent commentaries on Kiobel have contextualized the case with reference to Citizens United and the significant policy debates surrounding the Court's 2010 decision that corporations are legal persons with limited rights of free speech. As one Supreme Court observer questioned after the hearing, "the Supreme Court says corporations have a right to free speech. But can they get away with murder?"

Justice Breyer seemed to express particular discomfort with the potential implications of arguments that corporations are not "moral persons" under international law and therefore should not bear potential responsibility for certain offenses. Ms. Sullivan sought to allay fears of "corporate impunity," noting that "corporate officers are liable for human rights violations" and "there can also be suits under state law or the domestic laws of nations."

Nevertheless, in a post-Citizens United world, questions of the rights and responsibilities of companies as defined by U.S. courts have become the attention of much public debate and commentary. In addition, international developments, including the release of the Guiding Principles on Business and Human Rights, have directly addressed the responsibilities, if not liabilities, of corporations to account for the adverse human rights impact of their operations.

The circumstances for this week's Kiobel hearing therefore seems quite different than the context for the Supreme Court's earlier review of the ATS in Sosa v. Alvarez-Machain (2004). If the Supreme Court ultimately finds that corporations are not proper defendants in ATS cases, there may be considerably more backlash against such a finding than there would have been if the Court had decided the issue eight years ago.

Predictive Analytics, Informed Consent, and Privacy: The Case of Target

vkrishnamurthy@foleyhoag.com (Vivek Krishnamurthy) — Thu, 23 Feb 2012 04:00:20 -0500

A fascinating article in last weekend's New York Times Magazine discusses the powerful statistical techniques that some companies are using to analyze sales and other data in order to gain insights into their customers' behaviors and needs. The article raises a number of difficult consent and privacy issues.

The feature-length piece by Charles Duhigg uses the “predictive analytics” program developed by Target, America's third-biggest retailer, as a case study to illustrate how companies are combining data from customer interactions with other information obtained from commercial databases to draw strikingly detailed portraits of individual customers.

By combining information on the kinds of goods an individual purchases from their stores over several visits with other information about that individual's sociodemographic characteristics (such as age, ethnicity, and level of education) gleaned from public records databases, Target's predictive analytics program can deduce whether an individual shopper possesses characteristics that make them particularly susceptible to the specific marketing efforts.

According to the article, the most important of these characteristics for large retailers is pregnancy, for this is (understandably) a period of upheaval during which the shopping habits of the expectant parent(s) are most likely to change. Women who have been identified by the predictive analytics program as likely to be pregnant are then sent relevant coupons and other marketing materials in an attempt to win their retail dollars. Target's predictive analytics program has apparently become so good at correlating retail behavior with pregnancy that its booklets offering discounts on nursery items sometimes arrive in a customer's mailbox before the mother-to-be has informed other members of her household of the pregnancy!

In principle, there is nothing wrong with Target or any other company using information collected from various sources to fine-tune their marketing efforts or save their customers money by sending them coupons or special offers that are particularly targeted to them. There are, however, a number of problems with how Target and other companies from a wide array of economic sectors are deploying their predictive analytics programs in practice.

The first problem is that most companies are not informing customers of their data collection, retention, and analysis policies – let alone obtaining their consent to the same. Until the publication of the New York Times Magazine article last weekend, the only way that a consumer would know about Target's information collection and retention policies is by navigating to the company's website and reviewing its privacy policy.

Some retailers have partially addressed the informed consent problem by having their customers sign up for loyalty cards which must be presented in order to obtain sale prices. The fine print on the loyalty card application provides an opportunity for the company to state that it is collecting customer information for a variety of purposes. While these loyalty card applications can provide the consumer with some disclosure about what is happening, these fine-print disclosures are far from perfect—given that few consumers take the time to read the dense legalese before sending in the application form. What is more, there is nothing to prevent retailers with a loyalty card scheme from collecting, retaining, and analyzing purchase data from customers who have not bothered to obtain a loyalty card. For this class of customers, the loyalty card application form fails as a mechanism to obtain their informed consent to these practices.

The second problem is that there are no clear policies around the uses a company may make of the information that it collects from its customers–including at the point-of-sale. To stick with the example of Target, its privacy policy states the following under the heading of "Sharing with Other Companies (for their marketing purposes)":

We may share information with vendors, business partners and other organizations which are not part of the Target family. These companies and organizations may use the information we share to provide special offers and opportunities to you.

Such a policy may be appropriate for a business which sells an innocuous product, such as lumber or stationery. It is, however, manifestly inappropriate for a retailer that sells products ranging from food to clothing to nonprescription drugs. If an individual's purchases of these kinds of products can be used to determine whether she is pregnant, it is not difficult to see how a predictive analytics program could be used to determine whether a customer is overweight, diabetic, or sexually active – to name just three kinds of intimate details that can be revealed by the things we buy. Nor does it take a particularly fertile imagination to see how such information could be used by potential employers, insurance companies, and others in ways that no consumer would ever have dreamt about while waiting in the checkout line.

To be sure, there is nothing in the New York Times Magazine article to suggest that Target is selling or otherwise sharing product purchase information on an individual-by-individual basis with third companies. Even so, Target and other companies which are collecting data which may reveal the most intimate secrets of their customers must develop much more robust policies pertaining to the sharing of such data with third parties.

Companies also need to think long and hard about how and where they are storing these vast databanks of sensitive information, what they are doing to protect this information from prying eyes, and also just how long they need to retain this information in order to achieve their marketing purposes. To avoid the kind of controversy which followed the introduction of the Nectar loyalty card by Sainsbury's and other British retailers several years ago, smart companies need to start thinking about how to address these challenging issues today.

Liability and Immunity for Human Rights Violations: The Impact of Current Legal Developments on Corporate Responsibility

eholland@foleyhoag.com (Elizabeth Holland) — Tue, 21 Feb 2012 19:53:36 -0500

It is likely that the coming year will see a number of legal developments relating to the immunity and liability of corporations, states, and individuals as recognized by U.S. courts. With an increasing number of suits filed against companies for human rights abuses, the question of whether immunity attaches is of great significance.

Courts inside and outside the United States are weighing questions regarding jurisdiction and immunity, and their decisions and arguments will likely be picked up by other courts dealing with issues of corporate responsibility for alleged human rights violations.

What follows is a brief round-up of some of the most anticipated legal developments in the field of corporate responsibility to keep an eye on during 2012. In this overview, we look at three key questions under consideration by U.S. and international courts :

Can corporations, or their executives, be sued for human rights violations?
Does immunity under the Foreign Sovereign Immunities Act reach to corporations, states, and individuals?
What does international law say about state immunity?

(1) Can corporations, or their executives, be sued for human rights violations?

The answer to the question of whether corporations may be sued for human rights violations under the Alien Tort Statute (ATS) or Torture Victim Protection Act (TVPA) in the U.S. will have serious consequences in terms of corporate liability. With the Supreme Court preparing to hear arguments in Kiobel v. Royal Dutch Petroleum and Mohamad v. Rajoub on February 28, discussions are ramping up regarding liability and immunity in human rights litigation in U.S. federal courts. Between the two (consolidated) cases the Supreme Court will be looking at three questions:

Whether the issue of corporate civil tort liability under the Alien Tort Statute ("ATS"), 28 U.S.C. § 1350, is a merits question, as it has been treated by all courts prior to the decision below, or an issue of subject matter jurisdiction, as the court of appeals held for the first time. (Kiobel v. Royal Dutch Petroleum)
Whether corporations are immune from tort liability for violations of the law of nations such as torture, extrajudicial executions or genocide, as the court of appeals decisions provides, or if corporations may be sued in the same manner as any other private party defendant under the ATS for such violations, as the Eleventh Circuit has explicitly held. (Kiobel v. Royal Dutch Petroleum)
Whether the Torture Victim Protection Act, 28 U.S.C. § 1350 note § 2(a), permits actions against defendants which are not natural persons (Mohamad v. Rajoub)

All three questions will be of significant consequence in the field of corporate responsibility. Until now there was a circuit split as to whether corporations may be sued under the ATS. Notwithstanding the disagreement of whether a corporation may be sued under the ATS, it is clear that an individual corporate executive may be sued pursuant to the statute. Thus, depending on the decision of the Supreme Court there may be an increase in suits filed against individuals rather than corporations. This may lead to the emergence of an additional line of questions regarding individual liability for the actions of a corporation.

Lurking in many of these cases is the question of what exactly comprises the law of nations, which is referenced in the ATS. Some courts have concluded it is synonymous with customary international law, while others have rejected such an understanding. A clear definition of what amounts to the law of nations is critical to determining if a claim properly falls within the ATS. Though not one of the questions presented to the Supreme Court, it will be interesting to see whether the Court addresses it in its decision.

(2) Does immunity under the Foreign Sovereign Immunities Act reach to corporations, states, and individuals?

The Foreign Sovereign Immunities Act (FSIA) is the U.S. statutory framework governing sovereign immunity. The FSIA is the “sole basis” for gaining jurisdiction over a foreign state in U.S. courts. It codifies the restrictive approach to immunity, recognizing immunity for claims arising from sovereign acts. It also sets out a number of exceptions to immunity, including waiver by the state, commercial or private acts, territorial torts, or state sponsored terrorism. Though the FSIA definition of a state is drafted broadly enough that it could, under certain conditions, include corporations, there would be an exemption to the immunity otherwise afforded if the corporation (acting as an agency or instrumentality of the state) is undertaking commercial or private acts. For more on commercial or private acts exception to immunity, see this primer.

Statutes such as the ATS and TVPA provide the bases for human rights claims. These avenues for litigation, however, often bump against the sovereign immunity recognized by the FSIA. Despite arguments before U.S. courts and in front of the International Court of Justice (ICJ), there is no absolute exception to sovereign immunity based on violations—even of an egregious nature—of international human rights or humanitarian law.

To get around the sovereign immunity hurdle many claims regarding human rights violations are brought against individuals. This resulted in a circuit split on the question of whether the FSIA applied to individual foreign officials. In 2010 the U.S. Supreme Court answered this question in Samantar v. Yousuf. The Court held that the FSIA does not govern whether an individual foreign official is afforded immunity from civil suits before U.S. courts. Rather, foreign official immunity is governed (at least in U.S. courts) by common law.

The Supreme Court remanded the case to the federal district court for determination of whether the petitioner is entitled to foreign official immunity under common law. The Court, however, did not provide specific guidance as to whether such a determination should be predicated solely on the opinion of the Executive Branch, or that other bases—such as customary international law or practices of other national courts—should be considered (for more on this, see here). In a recent hearing on a motion for reconsideration the district court judge indicated that the opinion of the Executive Branch is owed deference, but is not controlling on the question. Thus, we should watch for an answer from the lower court as to what will be the basis for determining immunity. If the court bases its decision on customary international law it will be particularly interesting to see how it articulates the rule, and to what state practice it refers in determining its customary character.

(3) What does international law say about state immunity?

The ICJ looked at a related, but distinct question, regarding immunity: whether or not international law recognizes state immunity to civil suits filed in national courts. On February 3 the Court issued its judgment in Jurisdictional Immunities of the State (Germany v. Italy: Greece intervening). The Court held in favor of Germany, upholding a traditional conception of state immunity under international law. Regarding the primary claim, the Court found Italy had violated its obligation to respect the state immunity of Germany in part by allowing civil cases to be brought against the state in Italian courts. The Court was not swayed by Italy’s argument of a jus cogens exemption to the principle of state immunity, nor was it convinced by Italy’s argument that the acts of armed forces during an armed conflict fall within a territorial tort exemption.

In upholding state immunity as a matter of customary law, the judgment contained a number of interesting statements:

The Court characterized the current rule regarding state immunity as one of customary international law, rather than comity or grace (¶54, 56).
The Court described state immunity as a balance struck between the fundamental ordering principles of the sovereign equality of states and the territorial sovereignty of each state. Immunity flows from the former, exceptions to immunity from the latter (¶57).
The Court explained that, as is the case with state official immunity, jurisdictional immunity in a particular venue does not alter the applicability of the substantive rules governing the wrongfulness of an action (¶100). It pointed out that “whether a State is entitled to immunity before the courts of another State is a question entirely separate from whether the international responsibility of that State is engaged and whether it has an obligation to make reparations.” (¶100).

Though the judgment of the ICJ—which binds only the parties— is limited in its analysis to the narrow question of whether there is state immunity in regards to the activities of a state’s military, engaged in an armed conflict, on the territory of the forum state, its methodology and reasoning may—and likely will—will be picked up in future discussions regarding the broader nature of both foreign official and state immunity. This is especially likely given the Court’s clear recognition of state immunity under international law, and its rejection of the argument that there would be a jus cogens exception to immunity.

Finally, what should we watch for?

Looking ahead there are a few issues and questions that could arise in regards to liability for corporations, states, and individuals, including:

In a recent blog post, Professor Ingrid Wuerth suggests a few possible consequences of the ICJ judgment. The ICJ relied rather heavily on decisions of national courts in its recognition of state immunity as customary international law. Professor Wuerth queries what role national courts, especially those in the U.S., may play in reshaping the contours of state immunity.
Might the reasoning put forward by the ICJ strengthen arguments that absent an express waiver, customary international law recognizes state immunity for all non-commercial acts? This would be a high bar for any arguments in favor of exceptions to state immunity. To the extent U.S. courts consider customary international law in human rights cases this could be a significant hurdle to establishing any implied or implicit exception to immunity. For more, see this blog post by Professor Chimène Keitner.
To round it out, Professor Paul Stephens suggests in a blog post that the ICJ decision may be used to support an argument that prescriptive jurisdiction—the type exercised by U.S. courts in some human rights litigation—may contravene international law. He suggests that at some point the Supreme Court may well have to decide whether egregious violations of human rights warrant an exception to immunity, or must give way to it. If the Court adopts the former, it may well be in direct disagreement with international law.

Corporations doing business abroad will need to keep an eye on the developments regarding liability and immunity – particularly in U.S. courts where human rights litigation over the past decade has had a significant impact on the field of corporate responsibility. As potential claimants determine who to sue for alleged human rights violations, considerations of liability and immunity will dictate their strategy.

Responding to Government Demands for Content Restrictions: The Need to Focus on Responsible Implementation Strategies

vkrishnamurthy@foleyhoag.com (Vivek Krishnamurthy) — Mon, 13 Feb 2012 01:17:06 -0500

The announcement by Twitter last month that it is deploying the ability to block tweets on a country-by-country basis in response to government demand for content restrictions has generated an enormous amount of controversy.

Some commentators have accused the company, whose CEO once memorably described it as belonging to the “free-speech wing of the free-speech party,” of giving in to the demands of governments who take a narrow view of the freedom of expression in order to grow their business in lucrative new markets.

Other commentators view the decision as inevitable given that the company has grown to the point that it requires a physical presence outside the United States. This makes both Twitter and its employees vulnerable to jurisdictional assertions by foreign governments, including by democratic governments whose constitutions afford somewhat less expansive free speech protections than does the uniquely American First Amendment.

Still others have welcomed Twitter's development of a mechanism to block certain tweets from appearing in a particular country pursuant to a government request as sparing both Twitter and its users the far worse fate of the site being blocked entirely, as happened in China.

While reasonable people can certainly disagree on whether Twitter's new country-specific tweet blocking abilities are a positive development in principle, what has largely been missing from the public debate is a recognition that the manner in which such policies are implemented has almost as much of an impact on what effect the policy has in the real world.

Developing the ability to block tweets on a country-by-country basis does not necessarily mean that Twitter will honor every request it receives from every government. Twitter may well decide that such requests are only legally binding in countries where it hosts data or where it has employees who can be dragged into court on charges of contempt. Alternatively, Twitter may only accede to requests from governments that have the technical ability to block Twitter without switching off the entire Internet, as Egypt attempted to do at the height to the demonstrations in Tahrir Square.

Factors that are important to consider when reviewing a company's response to government demands for content restrictions include:

Who exactly within the company is making the decision on whether to honor a government request to restrict content? Are lawyers knowledgeable in the laws of the requesting jurisdiction making the call, or is the decision left to technical staff who may not have the expertise to judge whether a particular request is legitimate?
What is the internal process for reviewing decisions by frontline staff?
When if ever might the company challenge the request of the government in court?

All of these factors ultimately have just as much of an impact, in the case of Twitter's recent policy announcement, on the type and number of tweets that will be blocked in a particular country as the bare bones of the policy itself.

Finally, from a technical perspective, it appears that the precise means Twitter has chosen for blocking certain content on a country by country basis allows users to easily evade these restrictions. Twitter reports that it uses a visitor's IP address in order to determine their physical location. Recognizing, however, that IP-based geolocation is not perfect, Twitter allows users to manually specify their location in their account settings. This information appears to be saved in a browser cookie which appears to override IP-based geolocation for all purposes–including country-specific content restrictions. No one has been able to test the efficacy of this feature against Twitter's new country-specific blocking abilities for the simple reason that Twitter has yet to publicly acknowledge blocking a tweet in a particular country. The real test will surely come, however, the next time that the Internet is pressed into service as a platform for organizing antigovernment protests of the kind that rocked the Arab world last year.

The 2012 IFC Performance Standard on Indigenous Peoples: What's the Fuss?

alehr@foleyhoag.com (Amy K. Lehr) — Thu, 09 Feb 2012 18:47:42 -0500

The new IFC Environmental and Social Performance Standards -- in particular, Performance Standard 7 on indigenous peoples -- present a range of management and operational challenges for certain companies. For the first time, the Performance Standard includes a requirement of free, prior, and informed consent (“FPIC”) from indigenous peoples.

The new Performance Standards went into effect in January 2012 and are applicable to a greater number of the IFC’s investments than the 2006 Performance Standards, which only applied to project finance. Notably, the new Standards only apply to the IFC’s new investments, while the the 2006 Performance Standards apply to existing investments. Notably, the Equator Banks will apply the 2012 Performance Standards to new investments, which will result in their application to much of the world’s project financing.

The 2006 Performance Standard on indigenous peoples required “free, prior, informed consultation.” The requirement of consent in the new Performance Standard 7 comes on top of arguably more rigorous and complex requirements in Performance Standard 1 that address engagement with all communities.

Performance Standard 7 requires IFC clients to identify adverse impacts on indigenous communities and develop action plans to address them with the informed consultation and participation of affected indigenous communities. In addition, companies are expected to seek the FPIC of communities when:

The project will impact the lands and natural resources subject to traditional ownership or under customary use;
The project will require relocation of communities; or
The project will significantly impact critical cultural heritage of indigenous peoples.

What is FPIC? Definitions vary, but the IFC’s definition will be influential. The IFC requires FPIC to be established though a good faith negotiation with the community. In addition, the client should document that there is a mutually accepted process for obtaining consent, and should ensure that there is evidence that the parties agree on the outcome of the negotiations. As we suggested in a previously published report, Implementing a Corporate Free, Prior, and Informed Consent Policy: Benefits and Challenges, this means that companies should:

Develop a formal agreement on the process with communities;
Document the process to demonstrate it was followed; and
Document the agreement, if one is obtained.

In addition, the Performance Standard requires companies to involve indigenous peoples’ representative bodies and members of the affected communities, and provide sufficient time for decision-making. Finally, the process should include vulnerable groups, such as women and youth.

Our conversations with companies indicate that they are grappling with how to best implement the new standards. Many companies are accustomed to engaging in complex negotiations with indigenous peoples, but may need to adjust their practices. Specifically, they may be required to demonstrate, to the IFC or other stakeholders, that:

The engagement process used to obtain consent was not imposed unilaterally by the company. The process should be tailored to a particular situation in consultation with the community;
The process should seek the input of vulnerable groups and involve traditional decision-making bodies – again, precisely how this should be done may be culture and context-specific;
The community agreed upon the process used to obtain consent; and
The company has documented the community’s agreement to the project, including the scope of that agreement.

In short, for some companies, the new Performance Standard 7 will require significant changes to company engagement processes. In other instances, it may simply require companies to more effectively document their existing good practices.

Given the controversy surrounding large scale infrastructure on indigenous lands around the world, companies should consider reviewing their practices and filling gaps to ensure they maintain their social licenses to operate, as well as their financing. When conducting such a review, companies should bear in mind that most national laws require consultation, not FPIC, so mere compliance with national law may not be sufficient to meet the requirements of the new Performance Standard.