GNI developed this list of questions and answers to explain important aspects of the company assessment process.
The GNI Principles and their accompanying Implementation Guidelines establish a framework for responsible company decision making in the ICT sector, including in response to government restrictions and demands that may impact user freedom of expression and privacy rights. ICT companies should comply with all applicable laws and respect internationally recognized human rights, wherever they operate. If national laws, regulations, and policies do not conform to international standards, ICT companies should avoid, minimize, or otherwise address the adverse impact of government demands, laws, or regulations, and seek ways to honor the principles of internationally recognized human rights to the greatest extent possible. ICT companies should also be able to demonstrate their efforts in this regard.
The Implementation Guidelines provide operational guidance to ICT companies on how to put the Principles into practice, and also provide the framework for collaboration among companies, NGOs, investors and academics. Also see Appendix IV of the Assessment Toolkit: Mapping the GNI Principles to Implementation Guidelines that shows how the GNI Principles and Implementation Guidelines relate to each other.
Independent assessors will be accredited by GNI prior to their ability to perform assessments of member companies. Only accredited organizations are eligible to conduct assessments. The decision to accredit an organization is made by GNI’s multistakeholder Board, which has representation from each of its four constituencies – academics, civil society organizations, companies, and investors. See Section 5 of the GNI Governance Charter for more information on accredited independent assessors.
Assessors must demonstrate that that they meet GNI’s Independence and Competence Criteria.
Independence of Assessors: Assessors must be independent of the companies they assess. This means – among other things – that they must comply with a gifts policy, limit compensation to usual and customary fees and expenses, and complete and sign a disclosure form. The assessor organization must confirm the absence of certain factors that may impact their independence toward the companies they will assess, such as non-disclosure agreements, or legal or commercial constraints resulting from prior ongoing GNI-related work that may restrict its ability or willingness to conduct a comprehensive assessment and fully report its findings to the GNI Board.
Following the completion of an assessment, any individual or team selected to conduct an assessment will commit to being barred from seeking or accepting employment with the company assessed or undertaking any GNI-related advisory or assessment work for the company it has assessed for a period of 12 months. Finally, there are disqualifying factors that would impair the independence of an assessor, as well as factors requiring further consideration, which must be disclosed.
Competence of Assessors: Assessors must be competent by adhering to the highest professional standards in their work, grounded in the fundamental principles of integrity, objectivity, confidentiality, and professionalism. Competency requirements include subject matter expertise as well as skills and experience in human rights compliance and assessments or assurance. Assessors must also demonstrate administrative, physical, and technical measures to protect the confidentiality of information. See Section 5 of the GNI Governance Charter for more information on the accreditation process of assessors. See list of GNI accredited assessors.
At the completion of the process, GNI will publish the names of the assessors used during the 2018/2019 assessment cycle.
Company members of GNI who joined prior to 2018 are participating in the assessment process: Facebook, Google, Microsoft, Millicom, Nokia, Orange, Telefónica, Telenor Group, Telia Company, Verizon Media, and Vodafone Group.
Companies with observer status in the GNI do not undergo independent assessment. They will be assessed when they become full members. New members first undertake a self-assessment after one year of membership, after which they participate in the independent assessment process.
Assessors began company assessments during the latter half of 2018. Subsequently, the multistakeholder GNI Board reviewed the assessment reports on a rolling basis during its quarterly board meetings. Once the review of all company assessments is finalized by the end of 2019, GNI will issue a public assessment report.
The assessor examines the internal systems, policies, and processes a company has in place to implement the GNI Principles and reviews a set of case studies illustrating how those systems, policies and processes work in practice, following the guidance provided in the Assessment Toolkit.
The assessor prepares a report with its findings and recommendations on the performance of the company against the GNI Principles and Implementation Guidelines as set out in the GNI Assessment Toolkit to enable the GNI Board to make a determination.
The company has a reasonable opportunity to correct factual errors and suggest some revisions and redactions in accordance with the Privileged and Confidential Materials section of the Assessment Toolkit, before the report is shared with the GNI Board for review and determination. The assessor presents its report to the GNI Board at the board’s assessment review meeting followed by a Q&A session.
It is the role of the GNI Board to review each company assessment report prepared by the independent assessors. As part of this review, they meet with the assessors and the company representatives and ask questions of both. The board must then determine whether a GNI member company has met their obligations under the GNI Principles by making good-faith efforts to implement the GNI Principles with improvement over time.
Implementation of the GNI Principles is an evolving process designed to promote meaningful accountability while providing a framework to support collaborative learning and improvement over time. As such, the GNI assessment process recognizes that companies have to grapple with new and evolving freedom of expression and privacy challenges, and seeks to identify good practices, points of learning and opportunities for improvement.
When assessing ICT companies with billions of users located around the globe, it is not possible for the GNI Board to determine whether company policies and procedures are implemented properly in every instance or whether a company acts appropriately with respect to each of the thousands of requests it receives from governments every year.
The steps that can be taken by the GNI Board if it determines that a company is not making a good-faith effort to implement the GNI Principles with improvement over time are set out in the Accountability, Policy and Learning Framework and the Governance Charter. These include identifying corrective action steps, placing a company under special review, and should a company fail to meet compliance and evaluation requirements, terminating its participation in GNI.
The public report issued by GNI after the entire process is completed, includes a summary of progress made by GNI and the companies, GNI’s Board Determination of each company, collective lessons learned, and information required to improve the understanding of threats of freedom of expression and privacy across different sectors. In addition, each assessed company will, within six months of the end of the process communicate to the public about the outcome of their assessment.
Confidentiality is central to the quality of the assessment process. This allows companies to share relevant information and enables the GNI’s multistakeholder Board to review and discuss sensitive case studies of government requests from countries around the world in detail. To preserve confidentiality of the assessment process, cases presented in public assessment reports are aggregated, and most are anonymized. GNI is constantly seeking ways to increase transparency of the assessment process without compromising the critical importance of its confidentiality. The publication of the Assessment Toolkit is a concrete step to increase transparency and access to information.