GNI developed this list of questions and answers to explain important aspects of the company assessment process.
Companies participating in GNI are independently assessed every two years on their progress in implementing the GNI Principles on Freedom of Expression and Privacy (the “GNI Principles”). The purpose of the assessment is to enable the GNI Board to determine whether each member company is “making good-faith efforts to implement the GNI Principles with improvement over time.” Independent assessment includes both a company Process Review and a review of specific Case Studies:
Independence of Assessors: Assessors must be independent of the companies they assess. This means – among other things – that they must comply with a gifts policy, limit compensation to usual and customary fees and expenses, and complete and sign a disclosure form. The assessor organization must confirm the absence of certain factors that may impact their independence toward the companies they will assess, such as non-disclosure agreements, or legal or commercial constraints resulting from prior ongoing GNI-related work that may restrict its ability or willingness to conduct a comprehensive assessment and fully report its findings to the GNI Board.
Following the completion of an assessment, any individual or team selected to conduct an assessment will commit to being barred from seeking or accepting employment with the company assessed or undertaking any GNI-related advisory or assessment work for the company it has assessed for a period of 12 months. Finally, there are disqualifying factors that would impair the independence of an assessor, as well as factors requiring further consideration, which must be disclosed.
Competence of Assessors: Assessors must be competent by adhering to the highest professional standards in their work, grounded in the fundamental principles of integrity, objectivity, confidentiality, and professionalism. Competency requirements include subject matter expertise as well as skills and experience in human rights compliance and assessments or assurance. Assessors must also demonstrate administrative, physical, and technical measures to protect the confidentiality of information. See Section 5 of the GNI Governance Charter for more information on the accreditation process of assessors. See list of GNI accredited assessors.
At the completion of the process, GNI published the names of the assessors used during the 2018/2019 assessment cycle in the public assessment report.
Company members of GNI who joined prior to 2018 are participating in the assessment process: Facebook, Google, Microsoft, Millicom, Nokia, Orange, Telefónica, Telenor Group, Telia Company, Verizon Media, and Vodafone Group.
Companies with observer status in the GNI do not undergo independent assessment. They will be assessed when they become full members. New members first undertake a self-assessment after one year of membership, after which they participate in the independent assessment process.
Assessors began company assessments during the latter half of 2018. Subsequently, the multistakeholder GNI Board reviewed the assessment reports on a rolling basis during its quarterly board meetings in 2019. The review of all company assessments was finalized by the end of 2019, and GNI issued the public assessment report in April 2020.
The assessor examines the internal systems, policies, and processes a company has in place to implement the GNI Principles and reviews a set of case studies illustrating how those systems, policies and processes work in practice, following the guidance provided in the Assessment Toolkit.
The assessor prepares a report with its findings and recommendations on the performance of the company against the GNI Principles and Implementation Guidelines as set out in the GNI Assessment Toolkit to enable the GNI Board to make a determination.
The company has a reasonable opportunity to correct factual errors and suggest some revisions and redactions in accordance with the Privileged and Confidential Materials section of the Assessment Toolkit, before the report is shared with the GNI Board for review and determination. The assessor presents its report to the GNI Board at the board’s assessment review meeting followed by a Q&A session.
It is the role of the GNI Board to review each company assessment report prepared by the independent assessors. As part of this review, they meet with the assessors and the company representatives and ask questions of both. The board must then determine whether a GNI member company has met their obligations under the GNI Principles by making good-faith efforts to implement the GNI Principles with improvement over time.
Implementation of the GNI Principles is an evolving process designed to promote meaningful accountability while providing a framework to support collaborative learning and improvement over time. As such, the GNI assessment process recognizes that companies have to grapple with new and evolving freedom of expression and privacy challenges, and seeks to identify good practices, points of learning and opportunities for improvement.
When assessing ICT companies with billions of users located around the globe, it is not possible for the GNI Board to determine whether company policies and procedures are implemented properly in every instance or whether a company acts appropriately with respect to each of the thousands of requests it receives from governments every year.
The steps that can be taken by the GNI Board if it determines that a company is not making a good-faith effort to implement the GNI Principles with improvement over time are set out in the Accountability, Policy and Learning Framework and the Governance Charter. These include identifying corrective action steps, placing a company under special review, and should a company fail to meet compliance and evaluation requirements, terminating its participation in GNI.
The public assessment report issued by GNI after the entire process was completed, includes a summary of progress made by GNI and the companies, GNI’s Board Determination of each company, collective lessons learned, and information required to improve the understanding of threats of freedom of expression and privacy across different sectors. In addition, each assessed company will, within six months of the end of the process communicate to the public about the outcome of their assessment.
Confidentiality is central to the quality of the assessment process. This allows companies to share relevant information and enables the GNI’s multistakeholder Board to review and discuss sensitive case studies of government requests from countries around the world in detail. To preserve confidentiality of the assessment process, cases presented in public assessment reports are aggregated, and most are anonymized. GNI is constantly seeking ways to increase transparency of the assessment process without compromising the critical importance of its confidentiality. The publication of the Assessment Toolkit is a concrete step to increase transparency and access to information.