A/HRC/35/22 environment; and the potential to promote human rights throughout the company’s operations.94 Internal process and training 55. While dedicated business and human rights professionals within a company are important, due diligence should not be solely their responsibility, but must involve other relevant functional groups within the business. This requires dialogue and collaboration among various business units (such as privacy, law enforcement, government relations, compliance, risk management, product development and operations) and professionals (such as engineers, user-experience researchers, sales teams and business executives). 95 In the privacy context, researchers have found that measures such as “involving and assigning responsibility to senior business unit executives” for privacy management and “embedding staff with privacy protection expertise and personal responsibility for privacy … into the business units”, create an environment conducive to privacy protection. 96 Similar management practices could also ensure business respect for freedom of expression. For small and medium-size enterprises, these considerations might require the entire operation to engage in due diligence activities.97 External expertise 56. Given the wide knowledge base required, due diligence processes should draw on external, non-governmental expertise, including local civil society, international human rights organizations, the human rights mechanisms of international and regional organizations, academia and the technical community. Multi-stakeholder fora also provide opportunities for shared learning and mutual accountability. For example, researchers have found that membership in sector- or industry-specific human rights initiatives, such as the Global Network Initiative and the Telecommunications Industry Dialogue, coincides with companies’ human rights performance. 98 Consultation with users and affected rights holders 57. All digital access providers implicate the freedom of expression of end users in one way or another. Accordingly, even companies that are not consumer facing should consult end users as part of their risk assessment process. Such consultation is distinguishable from the broader multi-stakeholder engagement efforts outlined above and contemplates a “twoway dialogue” to “gather specific views or advice from affected stakeholders (or their representatives) that are then taken into account in the company’s internal decision-making and implementation processes”.99 For example, vulnerable or marginalized individuals and groups might be consulted while licensing negotiations in high-risk operating environments are ongoing or during the design, testing and rollout of zero rating policies. Meaningful consultation should also involve regular outreach to civil society organizations, which may provide a useful proxy for the needs and interests of end users in particular communities, and might themselves be at greater risk of pressure for their advocacy. Ongoing dynamic assessments 58. Companies should be quick to adapt due diligence processes to changes in circumstances or operating context. For example, risk assessment should continue after the 94 95 96 97 98 99 16 Ibid., pp. 310-312, for a more comprehensive overview of relevant topic areas that due diligence processes should cover. European Commission, ICT Sector Guide on Implementing the UN Guiding Principles on Business and Human Rights (2013), p. 36. Kenneth A. Bamberger and Deirdre K. Mulligan, Privacy on the Ground: Driving Corporate Behavior in the United States and Europe (Cambridge, Massachusetts, MIT Press, 2015), p. 177. European Commission, ICT Sector Guide on Implementing the UN Guiding Principles on Business and Human Rights (2013), p. 37. Ranking Digital Rights submission, p. 5. European Commission, ICT Sector Guide on Implementing the UN Guiding Principles on Business and Human Rights (2013), pp. 37-38.