Norway and the right to information under human rights principles

Jonathan Drimmer

Paul Hastings, Washington, DC

jondrimmer@paulhastings.com

The Norwegian Transparency Act[1], a broad law mandating that covered companies conduct human rights-related due diligence for their operations and supply chains, came into effect in July 2022.

The ambitious law is part of a rapidly moving trend across Europe to transform soft law human rights due diligence principles – particularly the UN Guiding Principles on Business and Human Rights – into hard law. These include comprehensive due diligence initiatives, as in Norway, which also have been adopted domestically in France and Germany. They also include more targeted requirements adopted in Switzerland (covering conflict minerals and child labour) and the European Union (as part of initiatives involving deforestation, digital services and other areas).

Other comprehensive due diligence regulatory requirements are being debated in a range of jurisdictions, including the EU’s well-known Corporate Sustainability Due Diligence Directive, Ghana’s National Action Plan and various similar initiatives in Latin America as part of this larger trend.

The Norwegian law is particularly expansive. It applies to Norwegian companies and foreign companies that operate in Norway, submit Norwegian corporate tax returns, and satisfy two of three – very low – threshold requirements: at least 50 full-time equivalent employees during the fiscal year, annual turnover of roughly US$8m, or assets of roughly US$4m. Substantively, as with many human rights due diligence legislative initiatives, it requires that covered entities:

• identify and assess actual and potential adverse human rights impacts that the entity has caused or contributed to, or to which the entity is directly linked;

• take steps to cease, prevent or mitigate adverse impacts;

• track the effectiveness of those steps;

• report publicly on:

  • the entity’s structure, operations, and processes for handling actual and potential adverse impacts;

  • actual adverse impacts and significant risks of adverse impacts;

  • steps taken or planned to cease or mitigate such risks; and

  • the effectiveness of those measures; and

• provide for or cooperate in remediation where appropriate.

However, the Norwegian law has one additional feature that makes it unique. Section 6 of the law includes a ‘right to information’. That essentially allows ‘any person’[2] – whether in Norway or otherwise affected by the company, including ‘other businesses, public bodies, civil society organisations, journalists and the general public’ – to ask a covered entity how the entity is addressing the actual and potential adverse impacts it has identified.

As the government has indicated, the purpose is for companies to be ‘open and transparent about how they are working with’ their issues. The answer need not be ‘perfect’, the government has made clear, only ‘adequate and comprehensible.’ The request can be rejected if it is unreasonable or unclear, or seeks private or confidential information. Importantly, Section 7 imposes a short response time: the request should be answered within three weeks (or two months if the information sought is burdensome). Should a company refuse to provide a response based on one of the few exceptions, the requestor may seek a more detailed justification for the denial and presumably seek relief from the government.

That ‘right to information’ is not found in any of the corporate human rights due diligence laws that have been adopted or proposed to date. However, the right itself has been recognised as a de facto part of the international human rights framework, and directly connected to the right to freedom of expression. Indeed, Article 19 of the Universal Declaration of Human Rights[3] and the International Convention on Civil and Political Rights (ICCPR)[4] both provide that freedom of expression includes freedom ‘to seek, receive and impart information and ideas’.

While freedom of expression traditionally focuses on the provider of information, the right to information focuses on the recipient, under a theory that access to information is a pre-condition to the full exercise of the right to freedom of expression. That theory is espoused, perhaps most authoritatively, by the UN Human Rights Committee (the Committee), in its highly influential General Comment 34 on Article 19 of the ICCPR, which expressly acknowledges that freedom of expression embraces a general right of access to information held by public bodies. The Comment, issued in 2011, further provides that parties to the ICCPR – eg, states – should proactively publish government information of public interest and ‘enact the necessary procedures, whereby one may gain access to information, such as by means of freedom of information legislation.’

That conclusion was underscored by the Committee in a case,[5] also from 2011, involving a request for information about the prison population in Kyrgyzstan. The Committee found that the reference to the right to ‘seek’ and ‘receive’ information contained in Article 19(2) included the right of individuals to receive state-held information without a need to prove a direct interest or personal involvement in the issue. Regional human rights courts, including the Inter-American Court of Human Rights and the European Court of Human Rights, have reached similar conclusions under their respective conventions.

In practice, states have recognised the right in different ways. Many have adopted laws, such as the US or UK freedom of information acts, giving individuals the right to seek information from the executive branch of government. The right also features in international agreements and conventions, such as the Escazu Agreement,[6] a broad agreement that provides the public with a right of access to environmental information.

Norway’s innovation, however, is the transposition of the right to information applicable to states to private companies. In principle, that is consistent with the business and human rights framework more generally, which admonishes companies to respect the human rights norms and conventions traditionally applicable to states, a point Yousuf Aftab[7] has explored extensively and persuasively. Indeed, Norway has its own Freedom of Information Act,[8] permitting the public to obtain access to information held by public agencies, subject to certain exceptions. Under the Transparency Act, covered companies have a similar duty: while they have an obligation to affirmatively report on their processes and steps to address negative impacts they have identified through their assessment activities, the public can ask for more.

There have been reports the public has done so. NGOs, investors, unions, and others outside of Norway reportedly are using this provision to seek information from multinational companies with Norwegian operations about how the companies are managing human rights risks and impacts. In essence, they are using the law as a discovery tool, seeking to obtain specific insights into global company programmes and issue management, and about how salient risks are being addressed. Given how the law has been used in the brief time it has been adopted, the government’s recommendation[9] that companies establish systems and routines for handling information requests seems prudent.

We have not yet seen other national governments or the EU adopt a provision similar to that in Norway. However, it is certainly something to watch. As the mandatory human rights due diligence trend continues to create hard law around fundamental rights (such as freedom of expression) and related issues (such as a right to information) there should be little surprise if others follow Norway’s path.