Civil liability for breach of due diligence duties – First thoughts on the comparison between the European Parliament recommendations and the European Commission proposal
About the author: Maria Inês de Oliveira is a tenured professor of Civil and Commercial Law at the Faculty of Law of the University of Coimbra, a private legal consultant in Portugal and Brazil, a member of the Institute for Legal Research of the University of Coimbra, of the Board of Directors of the Portuguese Chapter of the ‘Association Internationale de Droit des Assurance’” (AIDA) and of the Supervisory Board of the Institute for Banking, Insurance and Capital Market Law of the Faculty of Law of the University of Coimbra (BBS). She is also responsible for the Section of European Insurance Contract Law of the Institute of Iberian-American Law (IDIBE) and a member of the European Law Institute (ELI), of the German-Portuguese Legal Association (DLJV) and of the Brazilian Institute for Insurance Law (IBDS).
Roughly a year after the European Parliament (EP) had recommended the adoption of a Proposal for a Directive on Corporate Due Diligence and Corporate Accountability (on 10 March 2021), the European Commission (EC) adopted on 22 March 2022 its own Proposal for a Directive on Corporate Sustainability Due Diligence[1]. Unlike a previous draft framework stemming from the Committee on Legal Affairs of the European Parliament[2], both the proposals mentioned set out harmonised rules on civil liability for breach of due diligence duties – respectively Article 19 of the EP Proposal, and Article 22 of the EC Proposal[3].
The path leading to the EC proposal was rocky, and the sensitivity and complexity of the subject makes one expect that the text now proposed may considerably differ from the text finally approved[4]. As to the text issued by the EP, it is not even part of the legislative procedure. Nonetheless, it seems useful to contrast the provisions presented by both proposals on the matter of civil liability. The EP proposal is no doubt a road mark, generally taken into account (even if critically) in the ongoing discussion. This holds even more true for the EC Proposal, which set the line of departure in the present legislative procedure.
When putting side by side Article 19 of the EP Proposal, and Article 22 of the EC Proposal, three key differences immediately stand out.
The first regards the level of harmonisation. In fact, although the PE Proposal was not entirely clear in this regard, it did seem to be aimed at full harmonisation. This was the only straightforward interpretation that could be given to Recital 59 of the PE Proposal, where it read that “(…) [t]his Directive should aim for full harmonization of standards among Member States (…)”. Nonetheless, the statement was difficult to reconcile with how the proposed Directive provided for civil liability. Not only did Article 19(1) allow domestic laws to set out non-harmonised regimes on civil liability within the scope of the Directive, as it further laid down an harmonised regime that was both scarce and vague, and thus heavily reliant on the general concepts of civil liability of the member States. These aspects seemed to undermine any possibility of countering regulatory disparities between member States.
On its turn, the EC Proposal does not make any reference to full harmonisation. It even counters this purpose directly, when it states in Recital 62 that “[the] Directive should not prevent Member States from imposing further, more stringent obligations on companies or from otherwise taking further measures having the same objectives as that Directive”. The same idea is restated specifically in regard of civil liability in Article 22(4)[5]. The provisions in Article 22 must naturally be embedded in the domestic regimes on civil liability and will thus be co-determined by them. This is however part of the normal mechanism of minimum harmonisation. Moreover, the fact that the norms setting out the companies’ duties to which civil liability refers are more specific in the EC Proposal than in the EP Proposal (though the former still gives rise to considerable doubts) does leave less room for disparity.
The second difference regards the fact that Article 22 of the EC Proposal does not specifically provide for a defence based on the adoption of due care by the company, or on hypothetical causation processes, as was the case with Article 19(3) of the EP Proposal. In what regards the EP Proposal, however, the exact implications of the defence based on the adoption of due care were not clear. It suffices to remember that in some of the language versions of the Proposal (eg., the German, Italian or Spanish version), the expression used was the same as the one that referred due diligence duties – which would then point to a defence based upon compliance with the due diligence duties. In other versions (such as the Portuguese, the English or the French version), the terms used to describe the companies’ duties were different from those used to describe the defence – which would seemingly exclude that compliance with due diligence duties could exempt the companies from civil liability.
Now considering the EC Proposal, Article 22(2), on liability for the activities of an indirect partner with whom the company has an established business relationship, does seem to set out liability on the grounds of fault, since it provides that the companies shall only be liable in case of unreasonable behaviour. It should be pointed out that the unreasonableness of behaviour – i.e., fault – is not designed as a defence, but rather as a ground for the plaintiff’s claim. The same can be said for the general rule on liability, set out by Article 22(1). Although on its face the provision could be construed either as a ground for fault liability, or for strict liability, as it refers to the breach of obligations of means, it regards the failure to adopt a certain level of care (as shall be explained below), and thus refers to fault.
Although the EC Proposal does not mandate setting out a defence based on hypothetical causation processes, such a defence can still result from national laws. In what concerns Portuguese law, this will mainly regard the defence based on alternative lawful behaviour, in view of the traditionally restrictive stance towards the defence based upon hypothetical causation[6].
A third point that stands out regards how the required standard of conduct is designed. The EC Proposal is more precise than the EP Proposal in how it sets out the duties which infringement leads to civil liability. Instead of broadly referring to the fact that the undertaking “respect[ed] its due diligence obligations”, or “took due care in line with the [Directive at stake]”, as was the case with Article 19(1) and 19(3) of the EP Proposal, the EC Proposal specifically refers to the provisions which when infringed give rise to civil liability – see Article 22(1), referring to Articles 7 and 8, and Article 22(2), referring to Article 7(2-b) and (4) and to Article 8(3-c) and (5). Moreover, the provisions at stake do not merely set out a broad duty to take adequate measures to prevent, mitigate or put an end to certain adverse impacts. They particularise the measures that the companies are expected to undertake (Article 7(2) to (6) Article 8(3) to (7), which should be read together with Recitals 33 and 34). That is not to say that the measures prescribed are the most adequate, or that they do not leave room for doubt; but they make for less open-ended duties. The provisions at stake do bear some resemblance with § 6, § 7 and § 9 of the German Liefferkettengesetz, which may in some aspects have inspired the former (although, of course, the Liefferkettengesetz does not attach civil liability to the breach of the duties it sets out).
The design of the standard of conduct required by the EC Proposal deserves closer inspection. The scope of due diligence duties has often in the past given rise to doubts, even stemming from the ambiguity of terminology chosen, since due diligence can refer to an auditing process, as well as to a standard of care. It is therefore important to be specific while rendering the standard of conduct that should be adopted so as not to incur in civil liability.
Now, from the outset, it seems clear that the duties that Article 22(1) and (2) refer to are mere duties to exert best efforts. As mentioned, unlike Article 19 of the EP Proposal, Article 22 of the EC Proposal does not refer to a defence that could be construed as referring to the adoption of due care. However, the fact that the main obligations laid down by the Directive are devised as obligations of means is not only stated in Recital 15[7], as it results from the definition of the “appropriate measures”, which the company is obliged to implement under Articles 7 and 8. In fact, under Article 3(q), the appropriate measures are not all deemed necessary to prevent, mitigate, bring to an end or minimise adverse impacts; they are only those reasonably available to the company[8].
A second question that would now arise regards the object of such obligations of means. Namely, it stands to question whether the duty refers to the devising a strategy to prevent and address adverse impacts conceived ex ante – i.e., previously and independently of any actual adverse impact –, and to its implementation; or whether it refers to the adoption of any further ad hoc measures that may be adequate to address a specific adverse impact. The first approach could also be structured around a right of defence – that is, by exonerating the company when it proved that it had devised a strategy that ex ante seemed adequate, and that such strategy had been implemented.
A due diligence duty may be set out one way or the other, and has sometimes been designed by law as a blanket duty, comprehending an array of different conducts. The latter was the case for both Proposals under scrutiny (see Article 4 of the EP Proposal, and Article 4 of the EC Proposal). Identifying the object of the duty thus requires that one interprets the norms that define it. Under Article 22 of the EC Proposal, civil liability arises as a consequence of the infringement of certain aspects of the duty of due diligence – viz., those set out in Articles 7 and 8. It is clear that Articles 7 and 8 do not merely set out a duty to define ex ante a certain strategy (and to implement it); they also lay down duties to adopt remedial measures. This is especially clear in regard of the duty to bring adverse impacts to an end, as set out in Article 8. From the outset, the company is not only bound to address the adverse impacts that it identified under Article 6, but also those that it should have identified (Article 8(1)). Moreover, the measures set out in Article 8(3) are context-dependent – that is especially clear in regard of the duty to develop and implement a corrective action plan with reasonable and clearly defined timelines for action and qualitative and quantitative indicators for measuring improvement, where the adverse impact cannot be immediately brought to an end. Such a corrective action plan with reasonable timelines can only be appropriately designed ad hoc, before the particular circumstances of the case. At the level of indirect business relationships, Recital 57 and Article 22(2) are straightforward in establishing that the duties set out in this regard are not satisfied by mere ex ante measures. Under the terms of Article 22(2), that Recital 57 refers to, the company can exceptionally be held responsible when the measures adopted could not reasonably be deemed adequate in light of the circumstances of the case.
All in all, one can conclude that civil liability does not rest upon proving that the company contravened its own strategy; nor does the company exonerate itself by proving that it implemented the strategy it set out. The company can rather be held responsible for failing to adopt measures that were appropriate in light of the particular circumstances of the case.
From the standpoint of Portuguese law, a final question then stands out, regarding the relevance of construing such tort law duties as obligations of means.
In the Portuguese system of civil liability (as in the German system that influenced it) unlawfulness and fault are two necessary and separate requirements for liability (see Article 483 and Article 798, both of the Civil Code, respectively for liability in tort and for liability in contract). This devoids the distinction between obligations of means and obligations to produce or prevent a certain outcome of a considerable part of its practical effects. Even when the latter kind of obligations is at stake, and one establishes that the conduct which caused or failed to prevent a certain outcome was unlawful, then it must furthermore be established whether there was fault. As fault can be defined as failure to act with due care, it amounts to failure to deploy reasonable efforts. That is, even when the failure to adopt due care does not define the conduct required – and thus unlawfulness –, it then surfaces in the ascertainment of fault.
Differently, in the legal systems where fault does not side with unlawfulness as a general requirement for liability, the practical consequences of the distinction are momentous. Only when a duty of best efforts is at stake does one ascertain whether the debtor acted with the due diligence. When the standard of due care is not comprehended in the description of the conduct required, and thus in the ascertainment of unlawfulness, it does not “reappear” when ascertaining fault. When the duty to cause or to prevent a certain result is at stake, the fact that the debtor acted with due care is in principle irrelevant, although he/she may be allowed to resort to certain defences.
Nonetheless, the distinction can still have considerable consequences in systems (such as the Portuguese) that rely on a separate assessment of unlawfulness and fault, depending on how the burden of proof is distributed. When the plaintiff bears the burden of proof in regard of unlawfulness, and from this proof follows a presumption of fault (as is the case for liability in contract, in Portuguese law – see Article 799(1) of the Civil Code), then the distinction between the two kinds of obligations has great impact. Proof of unlawfulness is much simple when one has merely to establish that a certain result occurred/failed to occur than when one must prove failure to deploy best efforts. If from the establishment of unlawfulness follows a presumption of fault, then the plaintiff who relies on the breach of a duty to cause or prevent a certain result shall be dispensed from proving such failure to deploy best efforts.
However, under Portuguese tort law, where the proposed rules on civil liability would be embedded, the plaintiff generally bears the burden of proof regarding unlawfulness and fault, unless the law provides differently (Articles 483(1) and 487(1) of the Civil Code). As Demogue, who carved the distinction, famously considered in regard of the Code Civil, in view of the general rule of fault liability for non-contractual obligations, and of it falling upon the plaintiff to prove fault, all non-contractual obligations were in the end obligations of means[9]. Therefore, even the Proposal did not set out obligations of means, the plaintiff would in any case have to prove that the company failed to act diligently.
The distinction can naturally matter for the purposes of legitimate defence. Whoever claims to have acted in legitimate defence must prove that he/she was reacting to an unlawful aggression from the plaintiff (Article 337 of the Civil Code). As derives from the foregoing, this proof is much easier in case of infringement of duties to cause or prevent a certain result. However, establishing whether someone acted in legitimate defence against the company will naturally be relevant in actions brought by the company against third parties, and not in civil liability actions brought against the company (except where the company counterclaims for civil liability of the plaintiffs).
[1] Respectively, European Parliament resolution of 10 March 2021 with recommendations for drawing up a Directive of the European Parliament and of the Council on Corporate Due Diligence and Corporate Accountability (P9_TA(2021)0073), and Proposal for a Directive of the European Parliament and of the Council on Corporate Sustainability Due Diligence and amending Directive (EU) 2019/1937 (COM(2022) 71 final).
[2] Draft report with recommendations to the Commission on corporate due diligence and corporate accountability (2020/2129(INL)), of 11 September 2020; see Article 20.
[3] On the harmonised regime of civil liability set out by Article 19 of the EP Proposal, see Maria Inês de Oliveira Martins, “Proposta de Directiva relativa ao dever de diligência das empresas e à responsabilidade empresarial – Os pressupostos da responsabilidade civil”, DSR, 27, 2022, passim.
[4] For first in-depth reactions, see for instance the Online workshop organised by the European Corporate Governance Institute on the Proposal (available at the youtube channel of ECGI).
[5] Under its terms, “[t]he civil liability rules under this Directive shall be without prejudice to Union or national rules on civil liability related to adverse human rights impacts or to adverse environmental impacts that provide for liability in situations not covered by or providing for stricter liability than this Directive”.
[6] Some norms of the Civil Code regarding duties to prevent harm caused by other persons, or by buildings, goods or animals, do allow for the defence based upon hypothetical causation – namely, Articles 491, 492 and 493(1). According to the prevailing interpretation of the provisions, they provide for the inversion of the burden of proof regarding fault and thus set out liability for presumed fault. The defence based upon hypothetical causation is thus seen as a compensation for the severity of the regimes. Unlike Article 19(3) of the PE Proposal, Article 22 of the EC Proposal does not lay down an inversion of the burden of proof of fault, and thus does not bear such a direct analogy to the mentioned Articles of the Civil Code.
[7] Under Recital 15, “(…) This Directive should not require companies to guarantee, in all circumstances, that adverse impacts will never occur or that they will be stopped. For example with respect to business relationships where the adverse impact results from State intervention, the company might not be in a position to arrive at such results. Therefore, the main obligations in this Directive should be ‘obligations of means’. The company should take the appropriate measures which can reasonably be expected to result in prevention or minimisation of the adverse impact under the circumstances of the specific case. Account should be taken of the specificities of the company’s value chain, sector or geographical area in which its value chain partners operate, the company’s power to influence its direct and indirect business relationships, and whether the company could increase its power of influence”. For an interesting parallel, see the emphasis placed on the definition of the companies’ obligations as obligations of means by the German lawmakers (Regierungsbegründung, commentary to §3, I, p. 23).
[8] Under Article 3 (q), “”appropriate measure” means a measure that is capable of achieving the objectives of due diligence, commensurate with the degree of severity and the likelihood of the adverse impact, and reasonably available to the company, taking into account the circumstances of the specific case, including characteristics of the economic sector and of the specific business relationship and the company’s influence thereof, and the need to ensure prioritisation of action”.
[9] René Demogue, Traité des obligations en général, V, Librairie Arthur Rosseau, Paris, 1925, p. 542.