Corporate Social Responsibility and the Law : Foley Hoag LLP

The Obama Administration has filed an amicus brief with the U.S. Supreme Court in Kiobel v. Royal Dutch Petroleum in support of the plaintiffs' position that corporations are proper defendants in cases involving claims under the Alien Tort Statute ("ATS").  Filed on December 21, the brief was signed by the Department of Justice, the Department of State, and the Department of Commerce. 

The Supreme Court will review the Second Circuit's controversial decision that corporations cannot be properly sued under the ATS for violations of customary international law.  Notably, the Ninth Circuit, the D.C. Circuit, the Seventh Circuit, and the Eleventh Circuit have all upheld corporate liability under the ATS.

In its brief, the Administration states that neither international law nor "[t]he text and history of the ATS itself" provide a basis for distinguishing between natural and juridical persons. The brief then observes "[b]oth natural persons and corporations can violate international-law norms that require state action. And both natural persons and corporations can violate international-law norms that do not require state action."  

Stating that international law is the proper source of law for the relevant standards of conduct in ATS cases, the Administration states that "[w]hether corporations should be held accountable for those violations in private tort suits is a question of federal common law."  Federal courts must cautiously exercise their discretion to enforce specific international law norms and "[i]nternational law informs, but does not control, the exercise of that discretion."

Kiobel is scheduled for oral argument before the Supreme Court on February 28, 2012.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Former UN Special Representative on Business and Human Rights John Ruggie, now a senior advisor to our CSR practice, recently authored an article in Corporate Secretary magazine in which he observed that there has been a "convergence of expectations" with regard to business responsibilities in the area of human rights.  

These expectations are set forth in the UN Guiding Principles on Business and Human Rights, authored by Professor Ruggie and his team.  As discussed previously, these Principles were endorsed by the UN Human Rights Council in June of this year. Central to the Principles is the expectation that companies have a responsibility to respect human rights and that this requires companies to conduct human rights due diligence on their operations.  As noted by Professor Ruggie,

[h]uman rights due diligence requires companies to develop effective policies and procedures to assess the actual and potential human rights impacts associated with their activities and business relationships, and to act upon the findings.

Professor Ruggie observes that the Guiding Principles are "not just another set of voluntary standards vying for attention in an increasingly crowded space" but rather represent "authoritative UN standards around which the articulated expectations of many public and private institutions have already converged." (emphasis added)

Specifically, as noted in the article, the United States Council for International Business, the International Organization of Employers, and the International Chamber of Commerce have all voiced support for the Principles. The guidance set forth in the Principles has also been incorporated into:

• The revised Organization for Economic Cooperation and Development ("OECD") Guidelines for Multinational Enterprises;
• The revised International Finance Corporation ("IFC") Sustainability Policy and the corresponding Performance Standards; and
• The ISO 26000 social responsibility standard adopted by the International Organization for Standardization ("ISO"). 

The formal endorsement, and rapid incorporation, of the Guiding Principles marks 2011 as a transformative year in the field of business and human rights. Looking ahead to 2012 and beyond, companies should expect that stakeholder expectations with regard to corporate impacts on human rights will increasingly be informed by this new framework. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

I recently authored an article for IR Magazine on "CSR and the Role of the Board." In looking at board oversight in the area of CSR, one source that I relied upon was the 2010 report, Board Oversight of Environmental and Social Issues, published by Calvert Asset Management Company and The Corporate Library. 

The report analyzed board committee charters at S&P 100 firms and found that only 65 companies in the S&P 100 have board committees with some level of responsibility for oversight of corporate responsibility concerns. One of the most notable statistics from the study was the finding that less than 50% of those 65 boards monitor and provide recommendations on CSR trends and developments.

Ultimately, this lack of focus on trends is troubling.  Looking at developments in the CSR field over the previous decades, it is not hard to see that stakeholder expectations in the areas of environmental and social standards have often lead to the developments of new regulations, legislation, and lending guidelines.  As I noted in the article,

Understanding key trends is an integral component of effective long-term strategy development and can help ensure that companies have the capacity to respond to concerns when they arise. Companies regularly seek to identify trends in consumer preferences and in regulatory environments. Companies should exercise the same diligence in identifying future stakeholder expectations with regard to social and environmental performance. Stakeholder expectations in the area of CSR frequently ask companies to go “beyond compliance” with existing legal and regulatory standards. At the same time, these expectations are often predictive of the future content of legal and regulatory requirements.

A full copy of the article is available here (.pdf).

• Email This
• Print
• Comments
• Trackbacks
• Share Link

A developer for Google's Android mobile phone operating system has exposed what has the potential to be the most significant user privacy security vulnerability ever discovered in any computing device.

In a video posted to YouTube, Connecticut-based developer Trevor Eckhard has demonstrated how a program called Carrier IQ logs an astonishing amount of information about every aspect of mobile device use — from the full-text of SMS messages to the URL of every website visited using the device, not to mention every single keystroke that a user enters into their phone or tablet.

The Carrier IQ software is made by an eponymous company based in Silicon Valley (www.carrieriq.com) and is now known to come preinstalled on Android phones sold by many major carriers, including Sprint in the United States. The software launches automatically whenever a device on which it is installed is powered up, and there appears to be no way to disable or delete the software without “rooting” the device. It has not yet been confirmed whether the software is preinstalled on devices running operating systems other than Android, although this seems very likely given that a media alert issued by Carrier IQ earlier this month explains that its software is used for “counting and measuring operational information in mobile devices” including “feature phones, smart phones and tablets.”

In the same media alert, Carrier IQ denied that its software was being used to “record[] keystrokes or provid[e] tracking tools.” This denial appears to be contradicted by Mr. Eckhart's YouTube video, although in fairness to Carrier IQ, the video does not actually demonstrate the information collected by the software being transmitted to a mobile phone operator.

It is, of course, entirely possible that the potential the Carrier IQ software seems to provide for tracking nearly everything an individual does on their mobile device cannot actually be realized due to other aspects of the software architecture. If this is the case, Carrier IQ needs to explain that the user tracking potential of its software is the result of a programming oversight and move quickly to patch its software. If, on the other hand, the Carrier IQ software can be used by a mobile phone company to capture keystroke, phone call, SMS, or URL information, the company needs to inform the public immediately. One does not need a very fertile imagination to see what a formidable surveillance tool Carrier IQ might be in the hands of a totalitarian government, and users in such countries ought to know whether their mobile devices can be used to expose intimate personal information.

More generally, the Carrier IQ incident offers an object lesson on the importance of collecting and retaining the least amount of data required to accomplish a given task. There is no reason to doubt Carrier IQ's statement in its media alert that its software is designed to “assist operators and device manufacturers in delivering high-quality products and services to their customers” by “counting and measuring operational information in mobile devices.” That being said, there is no reason that keystroke, phone number, URL, or SMS data needs be collected in the level of detail in which Carrier IQ seems capable to optimize mobile devices or their network use. Reducing the amount of data collected to the bare minimum required is not only a good strategy for protecting user privacy and preventing data breaches, but it also helps companies avoid the glare of negative publicity when overbroad data collection capabilities are revealed.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link