Subject: [hrpc] Study on End User Policies - Support Requested

From: "Goldberg, Elizabeth" <[email-masked]>
Date: Wed, 11 Oct 2017 19:52:51 +0000

This is a quick interlude from discussion of the draft. I am hoping for kind hrpc members’ help in the form of conversations with those who work for Internet infrastructure companies.

I’m conducting research with Article 19 and Yale University on end user policies of Internet infrastructure firms, broadly defined. I’d specifically like to discuss firms’ implementation and accountability mechanisms developed to meet voluntary corporate responsibility initiatives, such as the UNGPs.

Please send me a message if you would be willing to connect or make an introduction.

Many thanks,
Beth (and Niels)

--
Beth Goldberg
MA-MBA Candidate | Yale, School of Graduate Studies

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 12 Oct 2017 10:36:25 +0200

Hi all,

A small addition to the email of Beth. Beth is a stellar student at Yale
University and she is studying corporate responsibility among IT actors.

In the field of the garment industry, banks, and the extractive industry
 the United Nations Guidelines on Business and Human Rights [0] [1] have
become common practice; 1000s of companies have signed up already:
https://www.business-humanrights.org/en/find-companies

In the IT sector the UN Guiding Principles have been adopted by some
actors (Ericcson, Nokia, Telia Sonera, Cisco) but not by all. This is
exactly the topic of research for Beth. From the companies who have
adopted the UNGPs she would like to know: what moved you to adopt these
principles, and now that you're using them, are they useful for your
business practices?
From infrastructure companies who haven't adopted them she would like to
understand why. Is this because you never heard about the UNGPs? Because
you think it's useless? Or because you think it' a distraction?

I've probably overly simplified the academic methods and questions of
Beth here, but this should give you some insight.

For us at ARTICLE 19 this would be tremendously useful to see what is
needed to further understand human rights impact by the Internet
infrastructure. We are developing an Human Rights Impact Assessment
Model with the Dutch ccTLD registry (SIDN) [2] and we could potentially
do this for other infrastructure actors (hardware providers, IXPs, ISPs,
CDNs, etc), but we only want to do this if this makes sense of course.

If you have any questions, suggestions or criticism, feel free to bring
it up here or contact Beth and/or me off-list.

Please consider giving a small amount of your time (or from the ppl in
your organization that would be responsible for this), to this research.

Thanks in advance,

Niels

[0] https://www.youtube.com/watch?v=BCoL6JVZHrA
[1]
http://www.ohchr.org/Documents/Publications/GuidingPrinciplesBusinessHR_EN.pdf
[2]
https://www.article19.org/resources.php/resource/38700/en/developing-a-human-rights-impact-assessment-model-for-internet-domain-registries

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    2458 0B70 5C4A FD8A 9488
                   643A 0ED8 3F3A 468A C8B3

On 10/11/2017 09:52 PM, Goldberg, Elizabeth wrote:
> This is a quick interlude from discussion of the draft. I am hoping for
> kind hrpc members’ help in the form of conversations with those who work
> for Internet infrastructure companies.
> 
>  
> 
> I’m conducting research with Article 19 and Yale University on end user
> policies of Internet infrastructure firms, broadly defined. I’d
> specifically like to discuss firms’ implementation and accountability
> mechanisms developed to meet voluntary corporate responsibility
> initiatives, such as the UNGPs.
> 
>  
> 
> *Beth Goldberg*
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 13 Oct 2017 10:08:03 +0200

On Thu, Oct 12, 2017 at 10:36:25AM +0200,
 Niels ten Oever <[email-masked]> wrote 
 a message of 172 lines which said:

> From infrastructure companies who haven't adopted them she would
> like to understand why. Is this because you never heard about the
> UNGPs?

Indeed, I've never heard about it. I'm not sure of what they
bring. Surely, these things, like slavery, are already forbidden by
law?

For instance, we are currently busy implementing GDPR, what's the
point of going the UNGP way?

---

From: "Goldberg, Elizabeth" <[email-masked]>
Date: Fri, 13 Oct 2017 20:18:48 +0000

Hi Stephane, thanks for your questions. Responses below:

>Indeed, I've never heard about [UNGPs]. I'm not sure of what they

The UNGPs<https://business-humanrights.org/en/un-guiding-principles> are guidelines for states and businesses to prevent, address, and remedy human rights abuses committed in business operations. They were developed collaboratively by the UN, businesses, and civil society from 2006-2011.

The point of the UNGPs is to set a global, authoritative standard on what is expected of businesses and states to uphold human rights, along with a blueprint for how to prevent, address, and remedy abuses. They are the first such widely endorsed initiative that defines responsibilities for both states and businesses.

The UNGPs differ from policies like the GDPR in a few critical ways:

- The UNGPs are voluntary. Regulations like the GDPR, on the other hand, come with a hefty fine for noncompliance.

- The UNGPs are comprehensive in scope, encompassing all internationally recognized rights in international law. They encourage states and businesses to identify their own human rights violations under international law, then address the most salient violations. The GDPR relates specifically to data protection.

- UNGPs set global standards, while the GDPR is only for the EU (for now). While abuses like slavery are obviously unlawful in some countries, they are not in all, so the UNGPs aim to put peer pressure on businesses globally to raise the bar and meet global standards.

________________________________
From: Stephane Bortzmeyer <[email-masked]>
Sent: Friday, October 13, 2017 4:08 AM
To: Niels ten Oever
Cc: [email-masked]
Subject: Re: [hrpc] Study on End User Policies - Support Requested

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 16 Oct 2017 16:12:20 +0200

In addition to the excellent explanation of Beth I can perhaps provide a
few other reasons:

- UNGPs can be seen as a for of 'non-financial risk assessment', so it
prepares an organization for everything that can happen. This was also a
reason (as far as I know) for Vodafone to commit to the UNGPs after what
happened in Egypt during the Arab Spring when they largely cut off to
the country.

- I've heard from ppl who implemented the UNGP that GDPR compliance was
much easier since they had already mapped everything and built clear
procedures

- UNGPs allows mapping for all human rights, which is not merely a
compliance issue, but also a exploration issue to understand which
layers and organization in the stack and the infrastructure are
responsible for what, which in turn also helps with informed policy making.

Best,

Niels

Niels ten Oever
Head of Digital

Article 19
www.article19.org

On 10/13/2017 10:18 PM, Goldberg, Elizabeth wrote:
> The UNGPs <https://business-humanrights.org/en/un-guiding-principles>
> are guidelines for states and businesses to prevent, address, and remedy
> human rights abuses committed in business operations. They were
> developed collaboratively by the UN, businesses, and civil society from
> 2006-2011.
> 
> 
> The point of the UNGPs is to set a global, authoritative standard on
> what is expected of businesses and states to uphold human rights, along
> with a blueprint for how to prevent, address, and remedy abuses. They
> are the first such widely endorsed initiative that defines
> responsibilities for both states and businesses.
> 
> 
> 
> - The UNGPs are voluntary. Regulations like the GDPR, on the other hand,
> come with a hefty fine for noncompliance.
> 
> 
> - The UNGPs are comprehensive in scope, encompassing all internationally
> recognized rights in international law. They encourage states and
> businesses to identify their own human rights violations under
> international law, then address the most salient violations. The GDPR
> relates specifically to data protection.
> 
> 
> - UNGPs set global standards, while the GDPR is only for the EU (for
> now). While abuses like slavery are obviously unlawful in some
> countries, they are not in all, so the UNGPs aim to put peer pressure on
> businesses globally to raise the bar and meet global standards.
> 
> 
> 
> 
> 
> ------------------------------------------------------------------------
> *From:* Stephane Bortzmeyer <[email-masked]>
> *Sent:* Friday, October 13, 2017 4:08 AM
> *To:* Niels ten Oever
> *Cc:* [email-masked]
> *Subject:* Re: [hrpc] Study on End User Policies - Support Requested
>