Due diligence at a group level

Abstract: The Proposal for a Directive on Corporate Sustainability Due Diligence is part of a growing concern with issues related to Environment, Social and Governance (ESG). In the Proposal analysed in the text below, it is mainly Environmental and Social factors that are at issue, dealing with how companies under scope must comply with due diligence duties, trying to avoid human rights and environmental adverse impacts throughout chains of activities. More recently, the Council proposed a new Article 4a which deals with due diligence obligations at a group level. The following lines will focus on these obligations.

1. Introduction

The Proposal for a Directive on Corporate Sustainability Due Diligence¹ in the compromise text resulting from COREPER meeting on 30 November 2022 (the CM version, or Council Mandate version) ‘lays down rules on (a) obligations for companies regarding actual and potential human rights adverse impacts and environmental adverse impacts, with respect to their own operations, the operations of their subsidiaries, and the operations carried out by business partners in companies’ chains of activities; (b) liability for violations of the obligations mentioned above;  and (c) obligations to adopt a plan to ensure compatibility of business model and strategy of the company with the transition to a sustainable economy and with the limiting of global warming to 1.5 ºC’.

The European Parliament adopted some amendments on the proposal on 1 June 2023 (this will be the EP version).² It keeps only two points in Article 1(1) as in the Commission Proposal, but it also introduced changes to the wording: it reads that the ‘Directive lays down rules (a) on obligations for companies regarding actual and potential human rights adverse impacts and potential human rights adverse impacts that they caused, contributed to or are directly linked to, with respect to their own operations and those of their subsidiaries, and the operations carried out by entities in their value chain with whom the company has business relationship and (b) on liability for violations of the obligations mentioned above which led to damage’.

Concerns about the protection of human rights and environment along the value chains are not new.³ The same may be said about applying the due diligence concept to achieve that goal.⁴ But the Proposal (CM version) uses the wording ‘chains of activities’ and assumes that reporting rules are not enough to achieve significant changes in corporate policies and that something must be done to ‘improve the regulatory framework on sustainable corporate governance’ (Recital (13)).

Although many companies have included ESG concerns in their decision-making processes,⁵ stronger incentives had to be considered to make companies abide to human rights and environmental protection. As has been stressed in the Study on due diligence requirements through the supply chain Final Report, ‘[j]ust over one-third of business respondents indicated that their companies undertake due diligence which takes into account all human rights and environmental impacts’.⁶

At first sight, the obligations imposed on the companies targeted by the Proposal (CM version) seem quite impressing, extending to the operations of their subsidiaries⁷ and with business partners in companies’ chains of activities. However, the Proposal’s subjective scope of application is very limited. It has been said that the Commission’s Proposal⁸ due diligence duty would only apply to around 1% of the companies acting in the EU.⁹ But those companies will have to act as a kind of delegated controllers.

As written above, companies will have obligations ‘regarding actual and potential human rights adverse impacts and environmental adverse impacts’ not only with respect to their own operation, but also to the operations of their subsidiaries and (part of) the chains of activities.¹⁰ This paper will give a closer look at the obligations with respect to the operations of the companies’ subsidiaries.

2. Subsidiaries: to be or not to be

A subsidiary is ‘a legal person through which the activity of a ‘controlled undertaking’ as defined in Article 2(1), point (f), of Directive 2004/109/EC of the European Parliament and of the Council is exercised’.¹¹ The subsidiary is not the ‘controlled undertaking’, but the legal person through which the activity of the ‘controlled undertaking’ is exercised.

A ‘controlled undertaking’ is ‘any undertaking (i) in which a natural person or legal entity has a majority of the voting rights; or (ii) of which a natural person or legal entity has the right to appoint or remove a majority of the members of the administrative, management or supervisory body and is at the same time a shareholder in, or member of, the undertaking in question; or (iii) of which a natural person or legal entity is a shareholder or member and alone controls a majority of the shareholders’ or members’ voting rights, respectively, pursuant to an agreement entered into with other shareholders or members of the undertaking in question; or (iv) over which a natural person or legal entity has the power to exercise, or actually exercises, dominant influence or control’.¹² This shows how extensive the companies’ obligations are.

However, it is easy to impose new duties on parent companies, but it may be very difficult for the latter to fulfil those obligations. In fact, company laws of different jurisdictions may limit the parent company’s powers concerning its subsidiaries. In Portugal, it is clear that in ‘Total Domination Groups’ and Groups formed by ‘Contract of Subordination’ one may say that ‘the parent company is given a broad legal power of direction over that management of the affairs of the subsidiary company (art. 493.º, nº 1, CSC), including the right to issue instructions disadvantageous or contrary to the interests of the latter in so far as such instructions serve the interest of the parent corporation or of any other group affiliate’.¹³ Things seem to be quite different when it comes to Relationship of Domination.¹⁴ But the latter will also originate a ‘controlled undertaking' according to the Proposal’s definition. The Proposal falls short in dealing with this kind of problems.¹⁵

Article 4(2) of the Proposal (CM version) reads as follows: ‘Member States shall ensure that, for the purposes of due diligence, companies are entitled to share resources and information within their respective groups of companies and with other legal entities’. But being ‘entitled to’ is not the same as having the duty to do it.¹⁶

We will give a closer look to the due diligence duty at a group level in the next point (3) of this paper. But other Articles in the Proposal (CM version) deal with the relationship between the company and its subsidiaries.¹⁷

3. Due Diligence Obligations at a Group Level: CM vs. EP

The CM version added article 4a allowing companies to fulfil part of the due diligence obligations at a group level.¹⁸ The EP version also adopted a new article 4a on the same subject.

Article 4a(1) CM version wants to impose on Member States that parent companies falling under the scope of the Directive have the possibility (‘may’) to fulfil obligations ‘set out in Articles 5 to 11 and Article 15 on behalf of companies which are their subsidiaries falling under the scope’ of the Directive.

That seems to mean that parent companies must have the power to act on behalf of the subsidiaries. Parent companies would not be fulfilling their own obligations, but the subsidiaries’ obligations… But if the parent company does not have the duty to fulfil the subsidiaries' obligations on the latter’s behalf (‘may’), the former will not be liable for not doing so.

In what concerns due diligence obligations, article 4a(2) CM version also refers to its fulfilment by the parent company and establishes a list of conditions. Although it is not explicit, it also appears that the parent company’s fulfilment of due diligence obligations relates to the due diligence obligations of the subsidiaries (‘in accordance with the paragraph 1’).

The EP version of Art. 4a(1) is a little bit different: ‘Member States shall ensure that parent companies may perform actions which can contribute to their subsidiaries falling under the scope of this Directive meet their obligations […]’. Now, it seems that parent companies will not be acting ‘on behalf’ of the subsidiaries. Once again, parent companies are not obligated to perform those actions (‘may’), and it is made clear that the due diligence obligations that are mentioned are the subsidiary’s obligations.

Both versions can cause some anxiety to its reader because none of them is clear about what is at stake. Starting by the CM version, the conditions set out in paragraph 2 for fulfilment of due diligence obligations by the parent company are lined up as if the parent company would only be allowed to act if the subsidiary also respects a list of obligations: provides information (a); abides by the parent’s due diligence policy¹⁹ (b); the subsidiary (where relevant) integrates due diligence into all its policies and risk management systems (c), in accordance with article 5, seeks contractual assurances and according to article 7(2)(b), or article 8 (3)(c), seeks to conclude a contract with an indirect business partner in accordance with article 7(3) or article 8(4)(e), and ‘temporarily suspends or terminates the business relationship’ in accordance with article 7(5) or article 8(6).

In the EP version, apart from some differences in wording and some consolidation, three new conditions appear: the parent company will have to adapt its due diligence policy in order to fulfil its obligations laid down in article 5(1) respecting the subsidiary (c), communication duties towards relevant stakeholders and the public domain emerge ‘where the parent company performs specific actions on behalf of the subsidiary’ (f) and there is a duty on the subsidiary to integrate «climate in its policies and risk management systems in accordance with Article 15’ (g).

It is very difficult to see if, and when, the parent company has powers that do not depend on other entities. One might even say that, if the subsidiary does nothing in what concerns conditions laid down in article 4a(2) the parent company may not act on behalf of the subsidiary (CM version).

The new Recital 16(a) of the CM version may work as a lighthouse: ‘In order to make due diligence more effective and reduce the burden on companies, they should be entitled to share resources and information within their respective groups of companies and with other legal entities, in compliance with existing national and Union law’. Therefore, the conditions in article 4a(2) should be read as imposing on Member States the duty to transpose the Directive creating the subsidiaries’ obligation to accomplish everything that is mentioned in paragraph 2 in order to allow the parent company to fulfil the due diligence obligations on behalf of the subsidiaries.²⁰

However, and as one may read in Recital 16c of the CM version, there is one limit: the obligations to share information do not include ‘information that is deemed to be a trade secret as defined in the Directive 2016/943/EU’.

On the other hand, Recital 16(a) shows that the ‘obligations at a group level should be limited to parent companies and subsidiaries both falling under the scope of [the] Directive’.

But Recital 16(a) also adds that if ‘the subsidiary does not fall under the scope of’ the Directive, ‘the parent company cannot fulfil due diligence on behalf of the subsidiary since the subsidiary is not obliged to carry out due diligence. In that case, the parent company should cover operations of the subsidiary as part of its own due diligence obligations’.

It also may happen that the parent company does not fall under the scope of the Directive, but the subsidiary does: in that case, ‘they still should be allowed to share resources and information within the group of companies’.

The EP version has also a new Recital on the subject (Recital 28a), but its wording seems unclear. It reads that ‘[p]arent companies should be able to perform actions which can contribute to the due diligence of their subsidiaries, where the subsidiary provides all the relevant and necessary information to and cooperates with its parent company […]’. Although one may see that parent companies are not obligated to act (‘should be able to’), the duty of the subsidiaries to provide information and cooperation is not written.

The new Recital 16(a) of the CM version reads that ‘[s]ince the parent company would be fulfilling these due diligence obligations on behalf of subsidiaries, the subsidiaries should only be required to fulfil the obligations that need to be performed at subsidiary level due to their nature’. And that could be very useful for those subsidiaries.

4. To Conclude

Groups of companies have different legal approaches in each EU Member States.²¹ The Proposal, the EP version and the CM version would require deeper harmonization of national laws on issues related with information exchange among group members and the powers of the parent company concerning its subsidiaries. Will the Directive on Corporate Sustainability Due Diligence be the reason for the emergence of a Directive on Company Groups?

30 November 2023