The French Loi de Vigilance: Prospects and Limitations of a Pioneer Mandatory Corporate Due Diligence

“Is there a common denominator between shareholders, multinationals, and their suppliers at the other side of the world? Our answer is yes. You may respond that businesses can’t see that far. I suggest an experience. Close your eyes: you won’t see anything. Open them: you will discover a different world, you will care for the most vulnerable, you will establish a Vigilance Plan, and the world will be better”.

These were the words of Dominique Potier, tireless Rapporteur on the Law de Vigilance  (“LdV”) during one of the nourished democratic debates.

The LdV is the result of a remarkable mobilization of trade unions, civil society and parliamentarians. It combines hard law with (international) soft law standards on business and human rights and introduces an unprecedented corporate duty of vigilance in French tort law.

Its adoption in February 2017 marked a blueprint for mandatory corporate human rights due diligence in France and in Europe. It also sends an unprecedented signal to businesses: the prevention of human rights abuses throughout their global supply chains and business partners falls under the scrutiny of a judge.

Despite being a pioneer and remarkable progress, the LdV carries a number of uncertainties concerning its implementation. Therefore, its first applications in French courts will be crucial to determine whether the LdV can serve a as a meaningful tool for protecting individuals and the environment against human rights abuses related to businesses activities.

Human Rights Due Diligence as a Preventative Means: The “Plan de Vigilance” as a Cornerstone of the LdV

The LdV is structured around two mechanisms. First, a civil duty of vigilance, seeking the prevention of risks and serious abuses to fundamental rights, health, safety of persons and the environment, related to business activities. Secondly, a reparation and liability mechanism for breaches of the obligation by companies.

Central to the LdV is the obligation for companies of more than 5,000 employees in France or 10,000 in France or abroad to establish, implement and publish a Vigilance Plan covering its own activities and those of its controlled subsidiaries, subcontractors and suppliers. The LdV and its preparatory works are remarkable, as they carve the Plan as a dynamic and context-specific vigilance obligation as opposed to a static “tick-the-box” exercise.

The Plan ought to first identify, analyze and map the risks resulting from the company’s activities. Secondly, it must include suited mitigating measures addressing these risks.

The mapping of risks is a crucial factor of the LdV, since it forms the basis for companies to determine mitigating measures and their implementation. To serve as an effective preventative instrument, the mapping of risks must reflect the reality of a company’s activity throughout its supply and commercial chain, as well the various stakeholders affected by these activities.

Unfortunately, the LdV is silent on the scope and methodology for this risk mapping and the mitigation measures. However, its overarching objective – the protection of individuals and the environment – suggests that due vigilance goes beyond traditional risk management processes protecting the company itself against legal and financial risks. The constant reference in the preparatory works to the OECD Due Diligence Guidance for Responsible Business Conduct and the United Nations Guiding Principles on Business and Human Rights (UNGPs) as the underlying philosophy of the Law indicate that both the risk mapping and prevention measures should be established “in concreto”, considering the  cultural, economic, sectorial and political context of a company´s activity. The LdV reminds transnational businesses that adverse human rights impacts cannot effectively be prevented by simple internal processes, but rather call for pragmatic and operational measures tailored to the specific activity, or business partner to which the risk is attached.

Thirdly, furthering the ambition of the Law to achieve more than an elaborated communication exercise, companies must implement and monitor the efficiency of their Plan. While little guidance is provided, this obligation echoes a “constant vigilant behavior”, as proposed in soft law standards for due diligence and advocated by civil society in France. Accordingly, the LdV provides that companies must “regularly assess the situation” in their supply chains and subsidiaries about the risks identified in their Plan.

Finally, the Plan and its implementation report must be made public. Whilst the LdV specifies that the Plan “is intended to be elaborated in consultation with stakeholders,” it does not impose it. However, it is clear that the legislator sought to enable stakeholders – in particular local communities – to participate in the elaboration of the Plan, scrutinize its implementation and be informed of the risks that a given activity may create for them.

A Broad Perimeter of Vigilance

Consistent with its ambition to prevent risks stemming from the global activities of businesses, the LdV provides that a broad spectrum of entities must be included in the vigilance “perimeter” of a company. This includes directly or indirectly controlled subsidiaries, as well as subcontractors or suppliers with which the company has an established commercial relationship. The concept of established commercial relationship covers all types of relations between professionals for a given commercial activity, with or without a contract, defined as stable, or creating a reasonable expectation of duration.

Interestingly, the wording of the LdV seems to target commercial partners of the company itself, but also those of its controlled subsidiaries.

The Prevention ‘tool-box’ of the Law – From Monitoring to Incentivizing

When a company fails to respect its Vigilance obligation, any party with standing – affected persons, as well as non-governmental organizations, trade unions or public municipalities – can formally notify (“mise en demeure”) the company to comply with its obligation. If the company does not comply within three months, the parties can request the competent judge to an injunction to comply with its Vigilance obligation to establish, implement and publish its Vigilance Plan. The judge can assort this injunction by the payment of a periodic penalty.

Such injunction can be sought through ordinary or interim proceedings. A question of major relevance for the preventative function of the LdV is: how will judges proceed with situations posing an imminent risk of human rights abuses? For instance, a construction project for a hydropower dam carries an immediate risk of forced displacement for local communities. In such situation, the suspension of the project could be necessary as a conservatory measure preventing the harm, until a decision on the necessary improvement of the Plan is issued.

Additionally, should a company be found liable for a breach of the Vigilance obligation, the judge can, at her appreciation, order the publication, dissemination or display of its decision – a reputational risk that it is hoped could incentivize companies in ensuring an effective control of their risks.

The Breach of the Duty of Vigilance: From Preventing Risks to Civil Liability

If a damage occurs that “the execution of these obligations [namely the Vigilance Plan] could have prevented”, any affected party with standing can seek reparation of her damage under tort law.

Three conditions are required for liability under French tort law: the breach of an obligation, a damage, and causality between the two.

It is worth clarifying that under the LdV, if a damage occurs through one of the entities falling in a company’s Vigilance perimeter, the latter can be liable solely for its failure to exercise vigilance throughout its supply chain, and not for the right’s violation causing the damage per se. As such, the LdV relies on individual tort liability for the breach of the Vigilance obligation – distinct from a third party liability for causing a human rights violation.

The LdV creates a duty of means (obligation de moyens), not a duty to ensure a concrete result (the effective prevention of a damage caused by third parties).  To comply with its obligation to establish, implement and publish a Plan, the obliged company should take “all reasonable vigilance measures” to identify and prevent adverse human rights impacts.

Since the LdV does not specify the content of this obligation, it is crucial that Courts clarify what constitutes a breach of this obligation. The mere fact that a risk that was not identified in a Plan led to a damage does not as such constitute a breach of Vigilance, unless the company failed to take “all reasonable measures” to identify the risk. Judges should clarify to what extent risk mapping under the Law must be context-specific. How much proactive engagement is required from companies to identify risks that are not inherent to their activities, but to which their activity contributes? The LdV aims at preventing risks “resulting from” (and not being caused by) the activity of a company or its subsidiaries. This means that risks covered by the Plan include human rights abuses by external actors to the commercial relationship – such as a State or armed groups – whenever these violations are related to the company’s activity. For instance: a company plans a project on an indigenous community’s territory in a given State. The State is responsible for guaranteeing the community’s right to free, prior and informed consent on the project, but fails to do so. This leads to serious conflicts and safety risks in the community that the Plan should address.

Similarly, while companies must implement and monitor the effectiveness of their Plan, they are not ultimately responsible for the behavior of third parties. Under the LdV, if a harm occurs, the failure of a subcontractor to have taken preventative measures included in the Plan of a company does not suffice to trigger the liability of the latter. It must be proven that the company has not complied with its Vigilance obligation, either by proposing non- adequate measures to the risk or the context, or by failing to monitor their implementation. For example: a company identifies risks of child or forced labor through one of its suppliers, and puts in place a Memorandum of Understanding for the recruitment of workers, and a reporting mechanism on working conditions. Would this MoU alone exculpate the company, or does the Vigilance obligation require it to apply leverage on its supplier to seek the respect of the MoU?

Moreover, if the risk identified involves an external party – such as the state or an armed group – is the company expected to disengage from its activities when measures proposed in the Plan can’t effectively mitigate the risk of contributing to the human rights abuse?  

An insufficient content of the Vigilance obligation may offer companies an easy way out of their Vigilance obligation, by identifying a minimum of risks and limiting the reach of their obligation to the global level. This would be contrary to the objective of the LdV, which calls for a judicial approach that transcends complex and multi-leveled operational structures of transnational businesses.

A Promising Law, but Substantial Obstacles in the Implementation and Access to Justice and Reparation Remain

So far, ¼ of the companies covered by the Law did not publish a Plan, while published Plans often barely mention the requirements of the LdV, without methodology used their risk mapping, merely stating general risks and ethical commitments. There is no available public list of companies subject to the LdV, which limits civil society’s monitoring of its implementation. There is no public oversight mechanism created to that effect either.

At the same time, there are certain problems that potential claimants could face: the redoubtable burden to prove the company’s failure of its Vigilance obligation is carried by the claimants. Secondly, claimants need to prove a direct link between an insufficient Plan and their damage. Thirdly, proving causality requires from claimants to prove that a hypothetical sufficient Plan could have prevented the harm from occurring.

Hopefully, the broad and adaptable wording of the LdV will be permeable to existing international soft law standards, and lead to an interpretation of the LdV considerate the specific contexts in which companies operate and its own intended effect: protecting individuals, groups and the environment against human rights risks caused by the activities of companies based in France.