Mandatory Human Rights Due Diligence in Germany and Norway: Stepping, or Striding, in the Same Direction?

I. Introduction

Germany and Norway are the two latest states to adopt laws mandating human rights due diligence by companies. Germany adopted a Law on Supply Chain Due Diligence (German Law) on 10 June 2021. ¹ The same day, the Norwegian parliament passed a Transparency Act (Norwegian Act) requiring human rights and decent work due diligence. ² Like the French Loi de Vigilance and the Dutch Child Labour Due Diligence Law, these laws provide further momentum for mandatory measures to promote corporate respect for human rights, including future regulations in the European Union (EU). While the aims are similar, the German and Norwegian laws contain certain important differences when it comes to the substance and scope of the due diligence requirement. In this context, adherence to international standards remains the way forward to ensure compliance with divergent requirements in different jurisdictions.

This piece offers a comparative overview of the background to the laws and legislative history in Germany and Norway in section II. Section III reviews the application of the laws and their substantive scope concerning human rights, decent work and environmental damages, the due diligence requirement, the coverage of subsidiaries and supply chains and finally, the information duties contained in the two laws. Section IV addresses monitoring and enforcement. Section V summarizes strengths and weaknesses of the laws, and relates this to the UN Guiding Principles on Business and Human Rights (UNGPs) and future mandatory human rights and environmental due diligence in the EU.

II. Background and Legislative History

A. The Norwegian Transparency Act

The Norwegian Act came about through a convergence of various civil society campaigns and political debates taking place since 2014. Following the Rana Plaza collapse in Bangladesh in 2013, a non-governmental organization, Future in our Hands (FIVH), mobilized more than 20,000 consumers to support a law that would give a right to information about working conditions at production sites, focusing on the apparel sector. ³ They referred to the Environmental Information Act 2003 as a potential model for a law on ‘ethics information’. In February 2016, politicians from the Christian Democrats, the Green Party and the Centre Party submitted a Bill for a law on ethics information, followed by two petition resolutions. ⁴

In June 2018, the Government appointed an Ethics Information Committee to examine whether it was ‘necessary and advisable’ to require businesses to disclose information to consumers and organizations about production sites used in manufacturing, responsible business conduct and supply chain management. ⁵ The Committee presented its final report, including a draft law and a legal commentary, on 28 November 2019. ⁶ After a public consultation and an impact assessment, on 9 April 2021, the Government presented its proposition to the Norwegian Parliament (Storting) entitled ‘Act relating to enterprises’ transparency and work with fundamental human rights and decent working conditions’. ⁷ It included the main building blocks of the original proposal, including a duty for larger enterprises to carry out due diligence with respect to human rights and decent work, a duty to account for due diligence and a right to know about how an enterprise addresses adverse impacts, as well as a system of enforcement and sanctions based on similar rules in the Norwegian Marketing Control Act.

The Standing Committee on Family and Cultural Affairs held a public hearing on the proposal in parliament on 29 April 2021, and made no amendments to the proposal from the government. After a parliamentary debate on 9 June 2021, the Norwegian Act received 70 votes for and 16 votes against on the subsequent day and passed the second reading on 14 June 2021. It received Royal Assent on 18 June 2021. The date for entry into force is yet to be determined.

B. The German Supply Chain Due Diligence Act

The debate about a mandatory human rights due diligence law in Germany can be traced back to mid-2010. Inspired by developments in France, civil society and academics began discussing what a German due diligence law could look like. The question about voluntary or mandatory measures shaped the process leading to the 2016 National Action Plan on Business and Human Rights (NAP). ⁸ Even though the voluntary approach ultimately prevailed, the German NAP contained a clear expectation from the government and indicated that mandatory legislation could be considered as an option if voluntary compliance by companies proved insufficient. ⁹

In September 2019, the civil society network, ‘Initiative Lieferkettengesetz’, was formed to promote a human rights due diligence law. ¹⁰ This platform quickly became the focal institution advocating for a law and has shaped the public debate since then. The government commissioned a review of corporate due diligence based on voluntary initiatives in 2019 and 2020. It revealed that only 13 to 17 per cent of all companies with more than 500 employees actively applied human rights due diligence. The debate shifted from the question of whether a law was necessary to what the law should look like. It quickly became apparent that the Federal Government itself was divided on this issue: while the Social Democrats with Labour Minister Heil supported by Development Minister Müller of the conservative Christian Social Union favoured a strong law, Economics Minister Altmaier of the Christian Democratic Union tried to water-down the scope and obligations of the law responding to intensive lobbying by business and industry associations. It took more than a year for the government to find a political compromise.

A bill was introduced to the Federal Parliament (Bundestag) on 19 April 2021. ¹¹ After two general debates and a hearing with experts in the Parliamentary Committee on Labour and Social Affairs, the Federal Parliament adopted the bill with a few adjustments. The final vote consisted of 412 votes in favour (Christian Democrats, Social Democrats, Greens), 159 votes against (right-wing Alliance for Germany and Free Democrats) and 59 abstentions (Left Party). Proposals by the Green Party to broaden the scope of the law and to include a specific section on civil liability were rejected. The German Law was published in the Federal Gazette on 22 July 2021. ¹² It will enter into force on 1 January 2023.

III. Application and Scope of the Two Acts

A. Companies Covered

The Norwegian Act applies to larger enterprises that are resident in Norway, offering goods or services in or outside Norway (Section 2). This includes larger foreign enterprises that offer goods and services in Norway and are subject to taxation in Norway. Larger enterprises include large enterprises as defined in the Accounting Act, as well as enterprises exceeding the threshold of two of the following three conditions: sales revenue of NOK70 million, balance sheet total of NOK35 million and/or 50 full-time employees in the financial year (Section 3(a)). It is estimated that the law will apply to about 8,830 enterprises.

The German Law applies to companies with a main seat or headquarters in Germany, irrespective of their legal form if they employ at least 3,000 employees, and to foreign companies of the same size with a domestic branch office in Germany (Section 1). From 1 January 2024, the relevant number of employees will be lowered to 1,000. The law does not apply to foreign companies without a main seat or domestic branch office in Germany, even if they supply goods and services on the German market. In practice, the law will apply to approximately 900 companies from 1 January 2023 and to approximately 4,800 companies from 1 January 2024. ¹³

The German Law thus sets a significantly higher threshold than the Norwegian Act. The Ethics Information Committee in Norway had originally proposed a duty for all enterprises to know about salient risks relating to human rights and decent work, but this was not part of the proposal from the government. Still, a low threshold is supported by the fact that the UNGPs set forth that all enterprises have a responsibility to respect human rights.

B. Substantive Scope

1. Human Rights, Decent Work and Environmental Damages

The German Law defines a human rights risk as a situation that may with sufficient probability result in a violation of internationally recognized human rights. It contains an open-ended indicative list of human rights violations such as child and forced labour, violations of the freedom of collective bargaining, discrimination, violation of adequate renumeration and other rights which are protected in the two global human rights covenants and the fundamental ILO Conventions (Section 2(2)).

The Norwegian Act covers fundamental human rights and decent working conditions. Fundamental human rights are defined in line with the UNGPs and the OECD Guidelines for Multinational Enterprises (Section 3(b)). The legal commentary also mentions the Convention on the Rights of the Child and the ILO Convention on Indigenous and Tribal Peoples. Decent working conditions are to be understood as work that safeguards fundamental human rights, health, safety and environment at work and crucially, work that provides a living wage (Section 3(c)).

The German Law extends the corporate due diligence to environmental risks, albeit in a very limited manner. Environmental risks are only relevant if there is a risk of violating the Minamata Convention on Mercury 2013, the Stockholm Convention on Persistent Organic Pollutants 2001 or the Basel Convention on Hazardous Wastes 1989. In addition, the law refers to the risk of polluting soil, water and air if this leads to violations of the rights to food, water, sanitation and health (Section 2(3)).

The Norwegian Act does not directly entail environmental due diligence, reflecting the delimitation of the mandate of the Committee that drafted the initial proposal. Environmental damages are covered insofar as they adversely impact human rights. The Socialist Left Party did not receive support for a proposal in the Norwegian parliament to include severe environmental damages in the due diligence requirement. Still, the government noted that the law will be evaluated at a later stage and that environmental due diligence requirements in future EU regulations would also require changes to Norwegian legislation.

2. Due Diligence Requirements

Due diligence requirements are at the core of both laws, but the definition of due diligence differs significantly.

The Norwegian Act explicitly sets forth the obligation to carry out due diligence in line with the OECD Guidelines (Section 4(1)). Due diligence, while limited substantively to human rights and decent working conditions, follows the six steps of the OECD Due Diligence Guidance for Responsible Business Conduct. The legal commentary includes extensive references to this Guidance and mentions the OECD sector-specific guidance. The commentary underlines that the enterprise shall only follow the due diligence steps that are relevant for the enterprise. Due diligence shall be carried out regularly and in proportion to the size and nature of the enterprise, the context, and the severity and probability of adverse impacts on fundamental human rights and decent working conditions (Section 4(2)).

The requirement to carry out due diligence in the Norwegian Act (Section 4(1)(a)–(f)) starts with embedding responsible business conduct in the enterprises’ guidelines. This is intended to include other relevant steering documents, routines and systems in the enterprise as well as embedding this in contracts with suppliers and business partners. Due diligence then involves identifying and assessing actual and potential adverse impacts on fundamental human rights and decent working conditions that the enterprise has either caused or contributed to, or that are directly linked with the enterprise’s operations, products or services via the supply chain or business partners. It then entails implementing measures to cease, prevent or mitigate adverse impacts. Due diligence involves communicating with affected stakeholders and rights-holders regarding how adverse impacts are addressed. The commentary notes that rights-holders include workers, trade unions, representatives from local communities and civil society. Finally, due diligence entails providing for or co-operating in remediation and compensation ‘where required’, that is, when the enterprise has caused or contributed to adverse impacts on human rights and/or decent working conditions.

The due diligence obligations in the German Law include the adoption of a policy statement, establishment of a risk management system, regular risk analyses, the establishment of preventive and remedial measures in the company’s own business and towards direct suppliers, the installation of a complaints procedure, documentation and reporting (Section 3(1)). The scope of the due diligence obligation is determined by the principle of appropriateness. ‘Appropriateness’ relates to the nature and extent of the business activity, the leverage of the company over the entity which immediately caused the human rights or environmental risk, the severity, reversibility and probability of the violation, and the nature of the company’s causal contribution to the violation (Section 3(2)).

The German Law obliges companies to conduct annual risk analyses to identify risks within their own business operations and at their direct suppliers (Section 5). Once risks have been identified, the company shall take appropriate preventative measures without undue delay, including appropriate procurement strategies and purchasing practices, training in relevant business areas, risk-based control measures and contractual assurances from a direct supplier to comply with the company’s human rights and environmental expectations and to address them throughout the supply chain (Section 6). Risk analyses are also required if the company must anticipate a significantly changed or expanded risk situation in the supply chain, for example due to the introduction of new products, projects or a new business field.

In case a human rights violation or environmental damage has already occurred or is imminent, a company must take immediate appropriate remedial measures to prevent, end or minimize this violation (Section 7). The termination of a business relationship is considered as ultima ratio: it is only required if the violation is very serious, the measures of the minimizing concept do not bring about change, and less stringent measures are not available. Remedial measures are merely directed at mitigation and cessation. In establishing and implementing the risk management system, a company is required to give due consideration to the interests of its employees, employees within its supply chain and others who may be directly affected by the company or by companies in its supply chains. The law is rather vague in this regard, but the official reasons of the law refer to consultations with affected persons or trade unions as an important participatory measure. ¹⁴ However, as consultations with persons that are actually or potentially affected are not mandatory, the German Law neglects the importance of stakeholder participation. Still, the law requires companies to establish an adequate company-internal complaints procedure to enable people to draw attention to human rights or environmental risks and violations. Such complaint procedures must be accessible, transparent, independent and trustworthy.

3. Coverage of Subsidiaries and Supply Chains

The Norwegian and German laws differ concerning the scope of due diligence in relation to business relationships and their alignment with international standards.

The duty to carry out due diligence in the Norwegian Act extends to the operations of the enterprise, supply chains and business partners.The legal commentary makes it clear that the operations of an enterprise encompass the activities of the parent company and its subsidiaries, irrespective of where the subsidiaries are registered. Business partners are defined as companies offering goods or services directly to the enterprise (Section 3(e)), such as cleaning services or marketing. A supply chain is defined as any party in the chain of suppliers and sub-contractors that supplies or produces goods, services or other input factors included in an enterprise’s delivery of services or production of goods from the raw material stage to a finished product (Section 3(d)).While there appears to be a potential limitation here, the legal commentary states that supply chains and business partners together are meant to be understood in accordance with the definition of ‘business relationships’ in the OECD Guidelines. The Act thus does not limit the duties to specific tiers in the supply chain and may in principle be interpreted as covering both upstream and downstream suppliers. A product that is returned as part of a circular economy for re-use may become part of a new supply chain and would thus also be covered.

On the other hand, the German Law’s coverage of subsidiaries and supply chains is problematic in light of international standards. As the law explicitly adopts a narrow understanding of supply chains, it is unclear whether the law covers the activities of subsidiaries that are not part of the supply chain of a parent company because they do not contribute to the production of the goods and supply of services of the parent company. In addition, even though the law generally applies to the entire supply chain, the specific due diligence obligation only applies to the company’s own activities and its direct suppliers. When it comes to indirect suppliers, companies are merely required to conduct a risk-analysis if they obtain ‘substantiated knowledge’ indicating the possibility of a human rights violation or environmental damage. If this is the case, the company shall adopt adequate preventative measures and draw up and implement a prevention, termination and minimization concept. This seems to suggest that companies are not obliged to exercise systematic due diligence towards indirect suppliers. The specific obligations are thus based on a graduated tier-oriented logic that runs counter to the logic of the UNGPs.

C. Information and Reporting Requirements

Both laws contain public information duties, albeit with different content and scope. The German Law requires companies to prepare an annual report on the fulfilment of their due diligence obligations in the previous financial year. Companies must, at a minimum, report on identified risks and on how the company fulfilled its due diligence obligations, including measures the company has taken in response to complaints. The report must explain how the company assesses the impact and effectiveness of the measures, and what conclusions it draws from the assessment for future measures. In case a company did not identify any human rights or environmental risks or violations, it must plausibly explain this in the report. The report must be made publicly available on the company’s website for a period of seven years.

The Norwegian Act contains two information duties. The duty to account for due diligence in Section 5 includes, at a minimum, a general description of the enterprise’s structure, area of operations, guidelines and procedures for handling actual and potential adverse impacts. This account should include information regarding actual adverse impacts and significant risks of such impacts as well as information regarding measures the enterprise has implemented or plans to cease actual adverse impacts, and the results or expected results of these measures. The public account is to be made easily available on the company website and shall be updated annually and in the case of significant changes to risk assessments. In addition, Section 6 contains a right to information on request. Any person has a right to information regarding how an enterprise addresses actual and potential adverse impacts on human rights and decent working conditions. This includes general information as well as information relating to a specific product or service. This may serve as an accountability tool for trade unions, civil society and other actors.

IV. Enforcement and Sanctions

Monitoring, enforcement and sanctions in both laws are placed with existing administrative agencies. In Norway, the Consumer Authority is charged with providing guidance to enterprises, monitoring and enforcing the law (Sections 8–11). It may impose fines for breaches of the duties enshrined in the Act. Violations of the due diligence duty and duties to disclose information – in public accounts or on demand – may result in prohibitions and injunction orders, including enforcement penalties (Sections 12 and 13). Repeated violations of the information duties may result in infringement penalties (Section 14).

The German Law is to be monitored and enforced by the Federal Office for Economic Affairs and Export Control (BAFA), which is under the Federal Ministry of Economics and Energy. BAFA will receive and assess company reports, has the power to adopt necessary measures to detect, end and prevent violations of the law and may summon people, request information and enter the premises of companies. BAFA may take such measures ex officio or upon request of persons with a substantiated claim that their rights have been, or are at the imminent risk of being, violated by a company through non-fulfillment of its obligations under the law. BAFA may also impose administrative fines of up to EUR500,000 or in some cases up to 2 per cent of the annual turnover of very large companies. Companies that have been subject to such fines may be excluded from public procurement procedures for a maximum of three years.

V. Conclusion

In both Norway and Germany, the level of engagement of various stakeholders has had significant impact on the scope of the two laws that have been adopted. A multi-stakeholder Committee and situating the legislative work within the Ministry of Children and Families in Norway, due to a consumer-oriented angle, probably contributed to creating an Act that is broad in scope. Emphasizing that human rights due diligence is to be in line with international standards contributed to broad political consensus, and ultimately, support from business. Input from trade unions and civil society organizations contributed to a law that in many ways is rights-based and stakeholder-centric. The due diligence duty extends to all human and labour rights and involves communication with, and remediation for, rights-holders. The law empowers the public with a right to information about adverse impacts. It remains to be seen whether the due diligence duty it contains is sufficient and effective when it comes to ensuring access to remedy for rights-holders that are adversely impacted by enterprises and their business relationships.

In Germany, the business lobby has been stronger and a voice for greater restraint in formulating the scope of the due diligence obligations. Yet, civil society and parts of the government ensured that the law contains mandatory due diligence obligations and company-internal complaints procedures. While the scope of the due diligence obligations falls short of the UNGPs, the requirements are specified in detail and thus provide legal certainty.

Neither law provides for civil liability. Nor do they oblige companies to implement specific remedies such as public apologies, guarantees of non-repetition or reparations in the form of damages or compensation. The German Law even explicitly excludes that a breach of the due diligence obligations under the law shall give rise to civil liability. However, this does not exclude liability claims on general tort law which would most likely be adjudicated based on the law in the jurisdiction where the damages occurred (lex loci damni). Civil liability has not been prominent in the debates in Norway, and the Socialist Left Party received little support for a proposal for an evaluation of how the due diligence duty relates to parent company liability.

Still, both laws contain novel and progressive elements that could influence the development of mandatory due diligence at the EU level. At the same time, EU legislation that includes comprehensive environmental due diligence and covers the entire value chain would incentivize and probably require reforms of these two laws. While representing significant strides forward from non-financial reporting requirements, a key challenge will be to avoid human rights due diligence becoming a tick-box exercise. Detailed, substantive duties to carry out human rights due diligence and meaningful engagement with stakeholders may serve to preclude this. Human rights due diligence laws require not only serious engagement by companies, but the continued involvement of trade unions, civil society and other stakeholders. They also demand an active role as well as sufficient competences and resources in the agencies charged with their enforcement. The two laws represent important contributions to the state duty to protect and the corporate responsibility to respect human rights. Guarantees for access to remedy are limited in both laws, however, and this is arguably where mandatory measures currently are most needed.