Digital Economy

FIs should develop specific policies and procedures to address the most salient human rights risks in relation to Digital Economy.

Digital economy policies and procedures should include a recognition of the corporate responsibility to respect human rights as set out in the UNGPs, including implementing human rights due diligence which reflects sector-specific risks. It should also include a commitment to human rights standards based on the International Bill of Human Rights and the ILO Fundamental Conventions.

Policies and procedures can also include a commitment to key sector-specific standards, as well as to standards which address the most salient human rights issues in the sector. These will differ between FI’s own business operations and retail lending, and policies in relation to financing operations. Any commitments by FIs to these standards, or any concrete expectations for clients/investee based on these standards, should be accompanied by an explanation of how the human rights-related expectations embedded in these standards will be implemented.

Policies in relation to FI own-business operations and retail lending

FI policies should address the human rights implications of the FI’s own use of digital solutions in its workforce and in its retail lending operations. These policies should reference relevant international standards – including data protection regulations (e.g. GDPR), ISO information security standards (ISO/IEC 27001/2), the Client Protection Principles – and cover data protection and privacy, labour rights for platform workers, and the FI’s use of AI in its own business operations (workforce and retail lending).

• Data privacy: data privacy policies must be aligned with international and national legal standards and include a human rights approach, which means understanding and identifying human rights risks and including measures/action plans to prevent and mitigate those risks in data management.
• FI use of platform workers: any platform workers engaged directly by an FI should be covered by the FI’s code of conduct for third-party employees, at a minimum ensuring respect for the ILO Fundamental Principles and Rights at Work, as well as statutory legal entitlements.
• Responsible AI in financial services: AI may be used by FIs in customer-focused applications, operations-focused uses, trading and portfolio management, and regulatory compliance and supervision. FIs should establish and maintain a statement of principles covering all these uses which articulates objectives, standards, and requirements in the form of an ethical code, to guide the adoption and application of AI. This should include taking an inventory of the AI use cases within the FI; undertaking specific human rights impact assessment when developing, using, or procuring new AI technologies that are likely to pose risks to human rights; establishing a clearly defined purpose for the use of AI and consider setting use limitations; and implementing a governance mechanism for the responsible use of AI, including non-discrimination and data protection.

Policies in relation to financing operations

FIs should develop sector-specific policies for digital economy investments which address key human rights concerns relating to the sector:

• Privacy rights: FIs should require clients / investees to adhere to robust data protection and privacy measures to safeguard user information and respect privacy rights. This can include maintain processes for responding to requests for information about users and processes concerning direct access agreements; responsible use of facial recognition technology; ensuring robust governance and policies over cybersecurity; and obtaining user consent for own collection, storage, and utilisation of data.
• Freedom of expression: where digital rights of expression are at risk, client / investee companies need to look to develop and maintain policies processes for responding to laws and regulations that impose censorship; implement transparent content moderation rules; and maintain clear processes for responding to orders for network disruptions or shutdowns.
• Broader salient rights for digital economy investments: client / investee companies should be required to ensure robust governance and policies over artificial intelligence; prioritise children and young people in addressing negative societal impacts; safeguard community and worker rights in value chains; and take actions to close the digital divide.

For further information, see ‘Taking Action – Strengthen human rights in FI policies’.

See also ‘Policy commitments and human rights’ for practical guidance on how to develop policy commitments which are consistent with the UNGPs, and how to integrate relevant human rights commitments in other policies and procedures.

Human rights screening and risk assessment should include key entities in the value chain, for example clients’ contractors and sub-contractors, suppliers and sub-suppliers. FIs should screen their Digital economy portfolio to map and identity salient human rights risks, whether their clients’ activities in the sector are likely to impact on vulnerable groups (workers and communities), and to evaluate the systems that their clients have in place to mitigate and prevent both risks and impacts.

FIs can seek to ensure that screening and risk assessments reflect key contextual risk factors in the digital economy:

• Operational and geographical context: In many jurisdictions, self-employed ‘gig workers’ are excluded in part or in whole from protections afforded by labour legislation; outsourcing – for example of content creation and moderation – to jurisdictions where labour laws are not adequately enforced; ICT services can negatively impact the right to security and other salient human rights issues in conflict-affected areas, including the use of technology to surveil, detain, and/or censor individuals or groups.
• Type of business relationship: Significant contractor/sub-contractor workforce, use of labour intermediaries or digital labour platforms.
• Client / investee-specific risk factors: Identify if the client / investee has any documented track record of causing, contributing to or being linked with human rights harms, including privacy abuses or data security issues.
• Presence of vulnerable groups: Identify whether the specific investment will include provision of services to vulnerable groups, such as children and young people, and those with limited access to digital networks.

See ‘Taking Action – Strengthen FI risk management systems and processes’. See also ‘Human Rights Screening and Risk Assessment’ for practical guidance on developing risk screening and assessment systems and processes.

Throughout the financial cycle, FIs should gather information on how clients / investees are managing specific human rights risks and impacts relevant to the Digital Economy.  This could include requiring clients / investees to provide information on:

• Labour rights and working conditions: the company’s employment policies and practices, including approach to ensuring fair wages, working hours, benefits, and job security; the company’s stance on workers’ rights to organise and engage in collective bargaining; the company’s approach to employment classification, protections and benefits provided to platform workers, such as health insurance, paid leave, and mechanisms for fair treatment.
• Labour incidents and / or worker complaints: mitigation/ prevention measures taken should extend to contractors and sub-contractors’ workforces, including platform workers.
• Data use: this includes how the company collects, stores, processes, and shares personal data, and ensuring that these practices comply with relevant data protection laws and respect user privacy; mechanisms for obtaining informed consent from users regarding data collection and usage; the company’s cybersecurity protocols and practices to protect against data breaches and cyber threats.
• Consultation: approach to consultation with potentially affected groups and other relevant stakeholders, including processes, participants, findings and outcomes.

FIs can also engage directly with Digital Economy clients / investees and use or build leverage to require, facilitate, and incentivize respect for human rights throughout the financing cycle. Effective client / investee engagement helps to build a common understanding of risks, gaps, and required actions. This ensures that measures can be adequately appropriated and implemented. This might include a focus on the following areas:

• Data privacy: in relation to ICT services in particular, projects may involve the transmission of substantial amounts of personal data, posing significant privacy risks for individuals. FIs can engage with companies on their use of information and approaches to ensuring cyber-security and avoiding data breaches.
• Safeguarding: supporting clients / investees in identifying specific rightsholder groups who may be disproportionately affected – including but not limited to children and young people, and those with limited access to digital networks. Engagement could focus on developing appropriate safeguarding measures.
• Value chains: the manufacture of hardware required by the digital economy – including computers, electronic and optical products may give rise to significant upstream human rights risks. FIs can encourage client / investee companies to create a comprehensive mapping of their value chains. By mapping their upstream value chains, businesses are able to begin to understand the possible human rights-related risks to which they are exposed, based on the countries where different commodities are sourced from.
• Algorithmic transparency: assessing whether the company’s algorithms and AI systems are designed and tested to avoid biases and discrimination, including data sources, algorithmic design, and outcomes, and that the company has mechanisms in place to audit, monitor, and address algorithmic biases and unfair practices.
• Freedom of expression and content moderation: the company’s policies and practices related to content moderation, ensuring they do not unduly restrict freedom of expression, and reviewing transparency reports regarding content takedowns, user data requests from governments, and other relevant practices.

See also ‘Taking Action – Client / Investee Engagement’.

Contractual requirements are also a common tool to build leverage, and FIs should consider integrating human rights considerations into financing contracts with clients, based on organizational human rights policies and commitments.

Pending financing modality, FIs can seek to use contractual leverage with clients to encourage the ‘cascading’ of human rights-respecting business practice along the value chain. This may commence with the requirement that the client / investee develops and implements a code conduct for suppliers and contractors aligned with the international standards which responds to all identified human rights risks for a defined scope of the value chain. Where appropriate, specific risk mitigants and process requirements – including monitoring, reporting and stakeholder engagement – can be elaborated in the action plan and covenanted in contractual agreements.

See also ‘Taking Action – Contractual provisions’.

Where risk assessments have identified potential human rights impacts, action needs to be taken. The type of action will depend on the severity and likelihood of the impact/s, as well as on how the FI is involved with the human rights impact/s.  In some financing contexts, such as project finance, environmental and social action plans (ESAPs) are an important and common tool for developing specific mitigants and responses in view of risks. In other cases, particularly where greater risks are identified, specific additional plans might be required.

FIs working with clients / investees in agriculture, forestry and fisheries (AFF) can focus efforts on the following areas:

• Platform worker protections: implement fair and transparent labour practices, ensuring workers’ rights and access to data, and providing mechanisms for collective bargaining to address challenges in the platform economy.
• Content moderation: establish a rights-based framework for the moderation of user-generated online content in line with the Santa Clara Principles on Transparency and Accountability Around Content Moderation; develop and implement psychosocial health and safety programmes for content moderators; and invest in technology to improve wellbeing for content moderators.
• Job displacement effects: at the enterprise level, employers should develop restructuring plans in accordance with the provisions of national law and applicable collective agreements, and which include an analysis of alternatives. Employers should consult with trade unions or other workplace representatives on avoiding or reducing redundancies, the method of selection – which must be objective, fair and transparent – and mitigating the effects of job losses. 
• Children’s rights: client / investee companies should develop policy and procedures to ensure compliance with the “safety-by-design” recommendations within the OECD Council on Children in the Digital Environment’s Guidelines for Service Providers. 
• Responsible AI: client / investee companies should develop policies and procedures algorithmic systems; explain how they work, including what they optimise for and what variables they take into account; and enable users to decide whether to allow them to shape their experiences. Companies should take actions to eliminate unintended racial, gender, and other biases in algorithms, including those recommended by the Equal AI Checklist to Identify Bias in AI.

For more general information, see ‘Taking Action – Action Plans and Specific Mitigations’.

In relation to the digital economy, this could include for example: refraining from financing the development and deployment of AI systems until appropriate human rights due diligence been concluded; refraining from financing surveillance technologies that violate privacy, enable discrimination and fuel violence against at-risk populations, such as human rights defenders.

Note that, within the EU, the Digital Services Act (DSA) specifically requires digital service providers to take measures to ensure that their services do not facilitate illegal activities or negative impacts on fundamental rights.

See ‘Taking Action – Avoid actions and omissions that facilitate or incentivise human rights abuses’.

FIs should work collaboratively with relevant stakeholders to inform their policies, identify risks, improve monitoring systems and grievance mechanisms, as well as to address entrenched human rights challenges in the digital economy. This should Involve meaningful consultation with potentially affected groups and other relevant stakeholders, as appropriate to the nature and context of the operation. The relevant stakeholders for FIs financing the digital economy, would include: other banks and investors with similar portfolios, industry associations, regulators, trade unions, industry associations and rightsholders affected or potentially affected by client / investee activities, and their legitimate representatives.

FIs and investors may join forces through peer-to-peer or multi-stakeholder efforts. For instance, the Investor Alliance for Human Rights has launched the ICT and Human Rights Working Group to support investor engagements with technology companies. The Principles for Responsible Investment (PRI) has also launched a Human Rights and Big Tech working group; nine investors are members of the Global Network Initiative (GNI), a multi-stakeholder platform that brings them together with ICT companies and civil society to promote digital rights.

FIs should ensure that clients / investees in in the digital economy engage with affected stakeholders. In the digital economy, some of the most important human rights impacts arise not from company operations or upstream value chains (though impacts do occur there) but from the downstream use of company products, services, technologies, and applications by (a potentially massive number of) users, and by the efforts of some governments to restrict users’ rights. Therefore, a digital economy company – and FI financing such a company – must balance engagement with people who have direct experience with human rights abuses with those who have the expertise to discuss the implications for the company and its potential paths forward. In this context, “intermediary stakeholders” may be key — organisations that are informed enough about developments on the ground or familiar enough with the technology to speak with authority and credibility, but who are also able to help the company think through the implications of these insights for business decision-making.

See ‘Taking Action – Stakeholder engagement and collaboration’. See also ‘Stakeholder engagement’ for guidance on collaborating, engaging and pursuing collective action.

FIs can enhance transparency and disclosure practices by providing stakeholders with access to sufficient, relevant and frequent information about finance and investments, including potential human rights impacts, mitigation measures, and grievance mechanisms. FIs can also develop and publish reports against clear indicators reflecting a human rights perspective, including salient issues, measures, and results.

When disclosing human rights information on its investments in digital economy companies, an FI should aim for transparency, accountability, and comprehensiveness. This disclosure should help stakeholders understand the bank’s commitment to human rights, the measures taken to uphold these rights, and the impacts of its investments. Disclosure may include:

• Information on the bank’s human rights policy/policies as they relate to the digital economy
• Criteria used to select digital economy companies for investment, including how human rights considerations are integrated into decision-making processes.
• Human rights due diligence processes used to screen potential investments in digital economy companies and summary findings of human rights impact assessments conducted before and after making investments.
• Mechanisms in place for ongoing monitoring of human rights performance in investee / client companies and specific human rights indicators and KPIs used to track performance, such as data privacy breaches, labour rights compliance, and diversity metrics.
• How the FI engages with stakeholders, including affected communities, employees, customers, and civil society organizations, to gather input and address human rights concerns.
• Information on feedback and grievance mechanisms available to stakeholders, and remediation actions taken to address and resolve human rights issues identified in investee / client companies.
• Reporting requirements imposed on investee / client companies regarding their human rights performance, including links to the transparency reports of investee companies, covering areas such as data privacy practices, content moderation activities, and labour conditions.
• Challenges or shortcomings encountered in upholding human rights in investments.

FIs should encourage digital economy companies to disclose information relevant to human rights impacts. This might cover areas such as the way in which software is used to censor content or restrict access to information, as well as data privacy and protection approaches.

See also ‘Taking Action – Transparency and disclosure’.

In relation to digital economy transactions, FIs can provide training and capacity building for FI staff on key human rights issues the identification, prevention, and mitigation of human rights abuses in the digital economy.

FIs should also ensure that clients / investees have sufficient technical, financial and logistical resources available, including an interdisciplinary team that includes qualified with human rights expertise and knowledge on the local context. This might include supporting clients to provide human rights trainings for relevant employees at corporate and/or operational level, for example on human rights issues relevant to data protection and privacy.

See also ‘Taking Action – Capacity building and training’.

FIs can work with clients / investees to establish robust monitoring and evaluation mechanisms to track the effectiveness of measures taken to prevent and mitigate human rights abuses. Policies and practices should be regularly reviewed and updated based on lessons learned and feedback from stakeholders. 

• Ongoing monitoring: FIs should establish processes for ongoing monitoring of the company’s human rights practices and impacts after the transaction is completed. This can include tools and technologies for automated monitoring of human rights risks, such as AI-driven analytics for detecting discriminatory practices or data breaches.
• Mix of quantitative and qualitative indicators: to effectively track the human rights performance of an investee /client company in the digital economy, an FI can use a range of qualitative and quantitative indicators, including data privacy, labour rights, non-discrimination, and freedom of expression.

At the operational level, FIs can support clients / investees to adopt monitoring mechanisms that are appropriate to the level of risk, and led by teams with relevant skills and expertise. In relation to the digital economy, FIs can focus on:

• Workforce indicators, including relating to wages, working hours, worker turnover and OSH indicators. This should also include indicators linked to the classification of platform workers.
• Indicators relevant to data protection and privacy, including in relation to data breaches.

See ‘Taking Action – Monitoring and disclosure’ for practical guidance on monitoring and evaluation processes to track human rights risks and impacts associated with business activities

FIs should ensure that accessible and effective grievance mechanisms are in place to enable affected stakeholders to raise concerns and seek redress for any reported human rights abuses related to their investment or lending activities in digital economy transactions and investments. This includes requiring clients/investees to have in place or to participate in a grievance mechanism aligned with Principle 31 of the UNGPs.

FIs can set up their own grievance mechanisms, participate in one or more grievance mechanisms established together with other FIs, or participate systematically in clients’ / investees’ grievance mechanisms.

In relation to workers, note that grievance mechanisms established by existing industrial relations systems and collective bargaining agreements can constitute effective and credible mechanisms to respect labour rights. FIs should give specific attention to ensuring that grievance mechanisms are available and accessible to platform workers

FIs can support clients to develop effective grievance mechanisms. There are a range of company-based grievance mechanisms that may be deployed by investee / client companies in the digital economy to remedy human rights harms: an ICT company which has a contractual relationship with users of services and which is likely to be subject to detailed regulatory requirements as regards customer service standards may need to put in place quite different arrangements for handling grievances than the operator of a social media platform with potentially global reach. In the latter case, the mechanisms and processes are likely to be shaped by a quite different set of operational and human rights imperatives, such as the need to operate at speed and scale in relation to a wide range of potential impacts that may be difficult to identify in advance.

One specific area where FIs can support investee / client companies, is in developing grievance mechanisms which are alert to the possibility that the range of people whose human rights might be adversely impacted by their business activities may not be confined to their own customers or users of their platforms or services. This could be the case, for instance, where technology is developed for a particular customer which is then deployed in a way that adversely impacts on the human rights of members of the general public (e.g. facial recognition technologies used by law enforcement agencies); or where a person’s personal data has been processed without their knowledge or consent (e.g. uploading of photos of a person onto a social media platform), or where disinformation about person or a group is spread by others through social media.

See ‘Taking Action – Improve and support the effectiveness of grievance mechanisms to ensure and enable remedy’.