Human rights due diligence and internet infrastructure

The uptake and scrutiny of corporate due diligence activities in the ICT sector over the last decade has happened unevenly, concentrating on Internet applications, platforms, and services that are more public-facing and largely overlooking infrastructural technologies and services including Internet registries and registrars, content delivery networks (CDNs), and Internet exchange points (IXPs).

From 2017 to 2020, ARTICLE 19 and the Danish Institute for Human Rights (DIHR) conducted a pilot project in partnership with three Internet registries and registrars, with the objectives of: developing, testing, and refining a first-of-its-kind, publicly available model for assessing the particular human rights impacts and risks of Internet infrastructure providers; applying the tool to develop recommendations for each partner company; and educating key staff and management personnel of each partner company on the human rights framework and human rights due diligence.

In June 2021, ARTICLE 19 and DIHR published this outcome report from the pilot project.

The report:

• provides an overview of the corporate responsibility to protect human rights at the infrastructural level
• explains the current state of human rights due diligence among Internet infrastructure providers
• presents the major human rights risks and challenges for Internet infrastructure providers that were identified through the project
• presents key observations, conclusions, and recommendations that may be useful for Internet infrastructure providers as well as stakeholders in academia and civil society that are advocating for greater human rights due diligence in the ICT sector.

The outcome report also identifies several fundamental sector-wide gaps that remain:

• The majority of Internet registries and registrars still lack explicit commitments to human rights and clear inclusion of human rights in existing due diligence systems, though certain systems may address specific human rights implicitly.
• Existing assessment frameworks and tools used by Internet registries and registrars heavily focus on aspects related to management and operations and are limited in assessing the impacts of their products and services on the communities that rely on them and society at-large.
• Human rights standards and expectations are generally not set as part of terms of engagement or agreements made with third-party suppliers and business partners.
• In general, the human rights framework is not applied to the development of internal company standards that can have clear human rights implications, such as anti-abuse policies.