A/HRC/35/22 ...but also uniquely situated to ensure respect for users’ rights 50. The industry’s dual role as an enabler of digital access and a natural point for Stateimposed restriction heightens its importance as a bulwark against government and private overreach. For example, providers are usually best placed to push back on a shutdown or user data request. Content delivery networks are strategically positioned on the Internet infrastructure to counter malicious attacks that disrupt access. Vendors are uniquely qualified to assess whether their products will be or are being used to facilitate human rights abuses, particularly when they conduct sales due diligence or perform ongoing services. B. Responsibility to respect users’ freedom of expression 51. To operationalize its human rights commitments, the digital access industry should allocate appropriate resources to at least the practices described below. Although these principles are evaluated in the context of digital access, they also bear relevance to other sectors of the digital economy, such as social media, commerce, surveillance and search. 1. Due diligence 52. Due diligence processes enable a digital access provider to identify, prevent and mitigate the human rights impacts of its activities (see A/HRC/17/31, annex, principle 19). While one-size-fits-all due diligence approaches are neither possible nor advisable, human rights impact assessments provide a means of assessing and addressing risks to freedom of expression and privacy.90 Due diligence involves at least the following. Policies governing the conduct of due diligence 53. Companies should develop clear and specific criteria for identifying activities that implicate freedom of expression and trigger due diligence processes. 91 The company’s past and ongoing human rights effects, as well as industry practice, provide useful indicators. In the digital access industry, such activities might include mergers and acquisitions; market entry or exit; government or non-government requests for content restriction or user data; the development of or changes to content restriction and privacy policies; product changes regarding content moderation or encrypted communications; arrangements that facilitate prioritized access to Internet content and applications; the design, sale and purchase of network interception and filtering equipment and technologies as well as associated training and consultation services. 92 This list, which is far from exhaustive, “requires constant vigilance and updating”, taking into account new areas of business, developments in technology, and other changes in operating context. 93 Issues to examine 54. Due diligence processes should critically examine at least applicable local and international laws and standards, including potential conflicts between local laws and human rights; freedom of expression and privacy risks embedded in the company’s products and services; strategies to mitigate and prevent these risks; limits on the effectiveness of these strategies given the company’s legal, regulatory or operating 90 91 92 93 threat of personal sanctions in case of non-compliance”. See Telecommunications Industry Dialogue submission, p. 11. Major telecommunications providers that have developed human rights impact assessments include Telia Company and Telefonica. Ibid., pp. 7-8. Nokia has embedded an automated feature that flags potential sales for human rights risks in its sales tool. Ibid., p. 7. European Commission, ICT Sector Guide on Implementing the UN Guiding Principles on Business and Human Rights (2013), pp. 32-36. Michael A. Samway, “Business, human rights and the Internet: a framework for implementation”, in Human Dignity and the Future of Global Institutions, Mark P. Lagon and Anthony Clark Arend, eds. (Washington, D.C., Georgetown University Press, 2014), p. 308. 15