The Mishcon Academy Digital Sessions.
Polly Green
Associate
Welcome everyone to our latest edition of the Role of Law series, a series of events focussing on how the law could and should be used more actively to drive the transition to a sustainable future. In this fourth edition we’ll cover the role of law in relation to building sustainable supply chains, an increasingly important consideration in an era of heightened stakeholder expectation and regulatory scrutiny. My name is Polly Green and I am an Associate in Mishcon’s White Collar Crime and Investigations Team. We often work with the Mishcon Purpose Team which is a team of lawyers and experts providing strategic ESG advice and purpose driven insight to help clients navigate the opportunities and risks presented by a rapidly changing world.
I am joined today by Ali Geary, who is a Partner in our White Collar Crime Team, Will Winch, who is a Partner in our Employment Team, Priya Thapar, a Managing Associate in our Data and Innovation Team and Margherita Cornaglia, who is a Barrister in the Mishcon Purpose Team.
So, we’re here to talk about supply chain and they’re a real hot topic at the moment. We saw through Covid how easily they could be disrupted. Companies are increasingly aware of how ESG issues faced their business performance and now that extends to ESG issues in their supply chains. Companies are facing increasing scrutiny on not just their own environmental and human rights standards but also their suppliers and consumers are more informed and they expect these ethical practices from brands that they support. We’ve also seen a shift in business perspectives. We’ve seen a massive transition from what was once shareholder capitalism to stakeholder capitalism so, historically, the primary focus was on delivering value to shareholders and the more contemporary approach that we’re seeing today emphasises the importance of all stakeholders, so that includes employees, customers, suppliers and the local community. So stakeholder capitalism is something that recognises that businesses have a broader responsibility beyond just profit and businesses must account for indirect exposures so that includes issues that appear in their supply chains. Alongside this the legal landscape has evolved. More global regulations are starting to appear surrounding ESG reporting and due diligence and that’s not just reporting on your own business operations but on your suppliers’ operations too. It’s led to the legal liability for businesses also expanding and companies are now being held accountable for the actions of not just themselves but their suppliers. This has led to more fines and penalties for non-compliance which have become steeper and companies also face criminal liability for the acts of their suppliers. There are massive consequences of overlooking ESG in supply chains, not just potential harm to a company’s reputation and their brand value but the economic repercussions of this, so a loss of consumer trust, reduced market share, there’s the legal implications that I’ve just spoke about so this comes in the form of legal proceedings, potential financial penalties and regulatory scrutiny. This all leads to then a potential difficulty in accessing capital markets or securing investments and companies might also face challenges in recruiting and retaining talent due to their corporate image. So, managing this ESG issues in supply chains is a real key part of mitigating risk and it’s no longer something auxiliary to what companies need to consider in this day and age. Proactively addressing these risks ensures longevity, profitability and sustainability for businesses in the modern era.
So, this webinar focussed on supply chains will run through a fictional case study of Prestige Goods which is a not real, UK based retailer selling apparel, home goods and groceries. Prestige Goods sources from more than 500 suppliers in 50 countries and they’ve come to Mishcon to seek advice on various issues that have cropped up in their supply chain. So we’re going to be going over four different scenarios with our panel of experts and we’re going to look at scenarios where there have been scrutiny over beef linked to deforestation in Brazil, allegations of forced labour in Bangladesh, instances of bribery in Southeast Asia, concerns about data handling in India and we’re hoping that today will just provide a bit of guidance on how to investigate these issues, the potential consequences of not dealing with them and best practices that companies can take away to mitigate any of these issues.
So first we’ll be talking to Ali Geary who will be helping Prestige Goods, or actually Prestige Goods USA, with a potential instance of bribery in their supply chains. So, I’ll just set the scene and then we’ll delve straight into it. So, Prestige Goods USA, which is a subsidiary of the UK based company, Prestige Goods, is a electronic supplier that sources raw materials for batteries from a state owned supplier in Southeast Asia. A new quality control manager at the supplier facility reached out to Prestige Goods USA’s ethical hotline and he reported that the suppliers purchasing manager had been making small payments to state officials who are responsible for contract pricing in order to receive favourable contract terms. He estimates that there could be around 500,000 dollars’ worth of payments made in the past few years and so obviously Prestige Goods is very concerned that there might be a potential violation of the UK Bribery Act by its supplier. They also want to know whether they might be captured by the FCPA which is the Foreign Corrupt Practices Act in the US. If bribery is confirmed, Prestige Goods might want to terminate the contract with the state owned supplier but the supplier plays a really key role in their supply chain, so ending the relationship has downsides too. Let’s focus on the corporate failure to prevent offence here in this scenario. In this scenario, who might be liable and in what way?
Alison Geary
Partner
To go back to the scenario, it’s always worth thinking about these things in terms or your sort of traditional structure diagram. So who we’ve got at the top here is we’ve got Prestige, the UK company, so I’m going to call them ‘Prestige UK’. They then have a subsidiary, ‘Prestige USA’, and then we have a supplier which I’m going to call ‘Southeast Asia Supplier’ or ‘The Supplier’. And we know that the act of bribery took place within The Supplier but because we act for Prestige, I’m not going to spend a long time thinking about whether or not The Supplier itself has committed a bribery act offence and whether there’s jurisdiction in relation to them and we’re not going to think about the individual inside The Supplier who may or may not have committed offence. We’re going to look at Prestige UK and Prestige USA. So, starting at the very top with Prestige UK, have they committed a bribery act offence? That question is going to come down to facts and circumstances and it’s going to depend on whether at the time that the bribe was paid, the supplier was performing services for Prestige UK. Prestige UK undoubtedly comes under the jurisdiction of the Bribery Act but I suspect from the scenario that we have, they may not be the case that the Southeast Asia supplier was performing services for Prestige in the UK so there may not be a Section 7 bribery offence there and again we would be looking at what the relationship is between Prestige UK and the supplier. In relation to Prestige USA, if it had been a member of staff within Prestige USA that had paid the bribe then likely that’s coming a lot closer to the UK entity and we might be able to say that there somebody performing services for the UK entity had made a bribe payment but Prestige USA on its own, we need to think about whether or not they could have committed a Bribery Act offence. Now we know that they’re a company based in the United States and so we have to ask well how far does the jurisdiction of the Bribery Act extend and that’s a question of whether or not Prestige USA is carrying on business in the UK, so we would be looking at Prestige USA and asking “Are you, Prestige USA, carrying on business in the UK? Are you marketing to customers? Are you selling directly? What’s Prestige USA’s relationship with the United Kingdom outside of the fact that it is simply owned by a UK entity?” If Prestige USA is carrying on a business in the UK, then we would need to say was the bribe payment made by somebody performing services for Prestige USA and if the answer is yes, then we’re going to be assessing their adequate procedures and if they have adequate procedures in place to prevent bribery.
Polly Green
Associate
Okay, so there’s quite a lot to digest there. If you were to summarise what would be kind of your key takeaways for companies looking to avoid potential criminal liability for any of these kind of corporate offences.
Alison Geary
Partner
If I were to give a two word summary or a three word summary, I think I must at times whisper in my sleep, ‘Risk based approach’.
Polly Green
Associate
So the second scenario for Will is in relation to modern slavery. So, the general council at Prestige Goods is still drafting the company’s Modern Slavery Act statement and it’s three months overdue. The delay is partly due to some revelations involving one of Prestige Goods’ main clothing suppliers in Bangladesh which is a large apparel factory with over two thousand workers. A local NGO conducted undercover interviews with workers outside the factory gates and they found that many workers had been compelled to work over a 100 hours a week to meet production targets, workers had wages unlawfully deducted for minor infringements and bathroom breaks and the passports of some migrant workers were allegedly confiscated by managers and they also had reports of physical abuse where workers were beaten for poor performance. So, the NGO stated that the factory conditions violated human rights standards in relation to forced labour and Prestige Goods is understandably very concerned about these allegations. The supplier factory play a major role in their clothing supply chain so replacing them could significantly disrupt Prestige Goods’ operations. They’ve come to us to try and figure out what to do next. So, Will, I think it would be useful to just start off with going over what a Modern Slavery statement is.
Will Winch
Partner, Knowledge Lawyer
So the Modern Slavery statement comes out from the Modern Slavery Act 2015, Section 54, if you’re really wanting to look it up, and it says that companies, big companies, £36 million a year turnover companies have to every year put together a Modern Slavery statement that basically sets out what steps, if any, they’re, they’re taking both within their business but also within their supply chain to make sure that Modern Slavery offences aren’t occurring.
Polly Green
Associate
You mentioned the six pillars set out in the Modern Slavery Act and one of them was due diligence. In this scenario, what are some of the considerations that the company should have made when going about their due diligence into their suppliers looking for something like modern slavery in their supply chain?
Will Winch
Partner, Knowledge Lawyer
Yeah, And I think that this is, this is a really good question because I think that, you know, the answer to the question originally would have been well I wouldn’t have started from here in terms of what do I need to do in order to get this right because obviously they’re rel… you know, they’ve got a real pinch point in their supply chain, a reliance on this, on this supplier is misplaced because they, this supplier may well be beyond redemption but what they should have been doing when they’re looking into due diligence and by the way only about 54% of companies do any due diligence into forced labour modern slavery before they actually enter into those contracts, that’s you know a bit research that was done a couple of years ago but things like ask what are your recruitment processes, what, you know, just doing a Google search, what are the news reports about this business, do you have, you know, are you operating in a high risk jurisdiction or an industry so look at the transparency international, they do a very useful world corruption index, you know, every year that you can see where, how well or badly your country is doing in that. Look at the number of women that are employed because they’re more, they’re, and if, the higher the number of women, the more strict due diligence you are going to need to do because they’re a vulnerable group and you need to do a bit more there, the number of migrant workers, the number of low skilled workers, whether there’s dormitories in the factories because that can be seen as being a bit of tied labour going on. Having a look at the working hours and standard shifts and overtimes and things like that, checking for unauthorised subcontractors for those businesses and also looking for debt bondage, things like are there recruitment fees, are there repatriation costs if you’ve got, you know if you’re a worker working for this factory, are you going to have to pay an awful lot to, to return to your home country? If you do a spot check on people’s employee records, are there missing pages as far as ID cards or age verification and things like that? And also, do you find when you open that thing, original passports because if you do that’s a massive red flag, it looks like you’ve got debt bondage there, you’ve got restriction of movement, so that’s not really a very good thing. I mean, there’s a lot of work but again, risk based approach, the more that you’re doing, you know for the bigger, you know for the bigger risks, for your bigger suppliers, you know that should pay off in the long term.
Polly Green
Associate
I’m going to just move on to our third scenario which relates to data protection and transferring data outside of the UK and the EU. So Priya will be helping me with this. In this instance, Prestige Goods is considering whether to switch their IT vendor to a Cloud services firm based in India because they’re providing really competitive rates for storing data. The vendor proposes to store and process Prestige Goods’ customer purchase data which means that Prestige Goods would be transferring that data outside of the UK and the EU, so in this case nothing’s gone wrong yet but Prestige Goods are aware that there might be some data related issues here. So a refocus on the UK GDPR today, what are the obligations for parties under this and how does it work? Who does it protect?
Priya Thapar
Managing Associate
So, you have to understand that the legislation is drafted in a way that when personal data travels outside GDPR jurisdiction, the protection travels with the data and that’s the entire basis on which you know you have the UK GDPR and GDPR and all of the privacy laws and legislations. So it’s the protection of personal data so then personal data leaves the UK, the protection travels with it and Chapter 5 suggests what are the requirements for companies before they transfer any personal data outside the UK. In this case, Prestige Goods would see what’s the security practices of the vendor? What are they doing? How are they handling personal data? What’s their privacy architect like? Do they have any security measures in place? In fact, Prestige Good being the controller, has a right to audit the practices of the vendor and you can amend this right within the contracted provision so you can say that Prestige Goods would have right to audit once a year or you can, you know, define or refine that right under the contract. Most of the vendors have wrap around technical and organisational measures, security measures, to provide to the customer so in this case Prestige Good should request technical and organisational measures from the vendor before it signs the SECs and you would see that all these requirements are pre-contractual so these are more like due diligence and something you have to do before you sign the agreement and you know, send the data out of the UK. So, the law requires you to take all these steps to do your due diligence, to investigate before you send personal data outside the UK.
Polly Green
Associate
So I’m just going to move on to our final scenario with Margherita and this is in relation to deforestation. One of Prestige Goods’ beef suppliers in Brazil has sourced cattle from farms engaged in illegal deforestation. The farm operates in the Amazon and it’s been illegally destroying habitats to make way for their cattle. So under forthcoming EU environmental regulations, Prestige Goods will need to conduct due diligence into deforestation risks and the UK has also introduced regulations banning imports linked to illegal deforestation. So if Prestige Goods continues to source from this Brazilian supplier, they might not meet UK and EU compliance standards but if they shift their beef supply chains that might incur significant costs and they might be faced with complexities. They’re also a bit worried that of the risks of criticism of campaigner groups and the pressures put on them by these groups for being linked to any Amazon deforestation. I mentioned that there were upcoming EU and UK regulations. What regulations in particular should Prestige be aware of and what steps would they be required to take under these regulations before they can place any of its Brazil sourced beef on the European and EU markets?
Margherita Cornaglia
Barrister
Thank you, Polly. So yeah, absolutely, there are regulations coming into place. I’m mindful of the time so I’ll try to be quick but please do get in touch if you have any further questions about these sort of very rapidly evolving landscapes when it comes to nature and climate. The first regulation that Prestige should be aware of is European Regulation 2023 1115 which came into force in June 2023. It’s also known as the European Deforestation Regulation and what it does is set mandatory due diligence rules when companies either place on the European market or export from it a number of commodities, palm oil, cattle, soy, coffee, cocoa, timber and rubber, as well as products derived from those commodities such as beef, furniture and chocolate. Now all of these derived products and their corresponding primary commodities are set out in Annex 1 if the regulation. So importantly what this regulation does is that it creates a due diligence chain. So take an example, take the example where an importer imports a commodity covered by the regulation, let’s say cocoa beans. It is the primary importer and is therefore subject to the regulations due diligence rules. When that primary importer sells the cocoa beans on the market, they are then handled by a large downstream operator who churns them into chocolate and they are then sold to a large trader as chocolate bars. Now both the large downstream operator and the final trader at the end of the value chain will be caught by the regulation as they are trading in a product that is derived from the risk commodities which the regulation covers. Now the regulation allows companies eighteen months from entry into force before requiring implementation of the rules. The regulation will therefore only start biting in December 2024. The main prohibition set out by the regulation is in Article 3 and obligations on companies then derive from that main prohibition. The prohibition essentially prohibits any product to be placed or made available on the market or exported from the market unless three conditions are fulfilled. The first is that they are deforestation free, which means that they are produced on land that was not subject to deforestation after the 31st of December 2020. The second condition is that they have been produced in accordance with the relevant legislation in the country of production and the third condition is that they are covered by a due diligence statement. Now the main obligation derived from this primary prohibition is then set out in Articles 4 and 5 which apply respectively to operators and traders and it boils down essentially to an obligation not to place products on the European market nor export them unless one has carried out appropriate due diligence, which means complying with three sub obligations specified in Article 8. These are first an obligation to collect information and documents, demonstrating that the relevant products are compliant with Article 3, as provided for by Article 9. Second, an obligation to implement risk assessment measures, as provided for by Article 10. This requires operators to verify and analyse information collected in accordance with Article 9 and carry out a risk assessment to establish whether there is a risk that the relevant products are non-compliant with the regulation. Third and finally, there is an obligation to implement risk mitigation measures, as provided for by Article 11. This one’s slightly trickier because if the risk assessment conducted under Article 10 reveals no risk of the products not complying with the regulation, then risk mitigation is not necessary. However, if there is reasonable doubt then operator must carry out risk mitigation procedures and measures that are adequate to reach no or negligible risk. Now I can’t delve into all the complexities of the regulation in the time we have today but two closing points on this. The first it that the regulation is nuanced so for instance it applies differently with diluted requirements to SMEs and a simplified due diligence regime is available pursuant for Article 13 for products that were produced in countries classified as low risk in accordance with Article 29. So my first piece of advice I guess for a company in Prestige’s position is to ensure that the regulation is properly understood, so to understand whether it applies for them, how it applies to them and to then prepare for having to comply with it very, very soon. The second closing thought is that something akin to the European regulation, as Polly mentioned, is likely to soon come into force in the UK once the Secretary of State passes secondary legislation pursuant to Schedule 17 of the Environment Act 2021 which focusses on prohibitions and obligations tied to forest risk commodities. So my second closing point is that the increasing crackdown on deforestation linked products is that unlikely to be an idiosyncratically European development and is increasingly likely to bite globally, so companies like Prestige that operate across the globe should pay a huge amount of attention not to just what’s happening in the EU and in the UK but globally.
Polly Green
Associate
Thank you and thanks for summarising that so succinctly, unfortunately, because we have run out of time. That cut concludes our case study. Thank you so much to all the panellists, it was really insightful. We covered a lot of ground and there’s quite a lot to digest there. As well as that, this is honestly only just a fraction of what companies need to begin considering to remain competitive and operate within current and upcoming regulations, as people have spoken about.
The Mishcon Academy Digital Sessions. To access advice for businesses that is regularly updated, please visit Mishcon.com.