Red Flag 16. Using data such that privacy and other rights are undermined

Using data such that privacy and other rights are undermined /

Collecting, holding or monetizing data about customers or users in ways that lead to adverse impacts on privacy, and other human rights.
For Example /
  • A social media or search company gathering, or sharing, user data without the consent of those users
  • Information and communication service providers operating in or expanding into new markets, which agree to share information about political activists or members of persecuted communities with governments that use it to violate those people’s rights
  • Data brokers selling comprehensive consumer profiles as a raw product without the consent of those individuals
  • The digital transformation of various industries through the Internet of Things (IoT), including home appliances, car manufacturers, toy companies and many others, leading to a ubiquitous processing of personal information with a lack of human oversight, creating potential impacts on privacy where this data is used and shared.
Higher-Risk Sectors /
  • Multiple Segments of the Technology Industry:
  • Telecommunications, Internet Service Providers, and Web Hosting companies
  • Data Center or Cloud Service providers
  • Social Media platforms, and search engine, email and messaging service providers
  • Providers of web or mobile phone Apps
  • Companies supporting online communities and gaming
  • Consumer tech devices and service providers
  • IT firms providing digital services to government agencies
  • AI development companies (developing AI solutions that process or require handling of customer data)
  • Non-technology companies whose business model is increasingly tied to the use of data on customer habits or movements, such as household appliance manufacturers and automotive companies. Increased digitalization across industries, the use of IoT and AI etc., also increases the types and number of companies collecting and processing personal data.
  • Data brokers that collect data (e.g. from the internet, government sources etc.) and buy it from other companies (e.g. credit card companies) to either sell comprehensive consumer profiles as a raw product or sell big data analytics as a service (e.g. for risk evaluations, price optimization, targeted advertising).
Download Red Flag 16

Questions for Leaders /

  • Have we established that the business benefit of collecting customer or user data actually outweighs the costs of protecting those data, and the risks of data breaches? Have we analyzed the relative merits of not collecting or holding this type of data?
  • Do the incentives that drive our data collection undermine the ability of people to give their consent to us collecting and using it?
  • How confident are we that the entities we are selling to, or sharing data with will not expose, misuse or abuse that data?
  • How adequate are our scenario planning, training and action plans for potential breaches of data security?

Understanding Risks
and Opportunities /

There are a range of reasons why companies in diverse sectors are collecting and holding data. For example, private hospitals and pharmaceutical companies may do so to improve diagnoses, improve treatment plans and develop medicines; banks may use personal and transaction data to identify fraud; and autonomous vehicle companies may seek to monetize data about customer driving habits to enable individuals to improve insurance premiums. Even so, in order to fully realize these benefits for businesses and people, the following risks must be managed.

  • Right to Privacy: Where a company collects, holds or provides third parties with access to data about customers or users, there are inherent and widespread privacy risks. Examples include:
    • Where information about an individual is collected, sold or shared without their consent. This includes when data are used for purposes beyond those originally consented to by a “data subject.”
    • Where data breaches result in individuals’ personal financial or health data being publicly accessible.
    • Breaches of sensitive personal information, such as racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, sex, gender identity or sexual orientation, genetic data, biometric data, or data concerning health.
  • Freedom from Arbitrary Attacks on Reputation and Right to an Adequate Standard of Living: Where the personal data becomes accessible to the public, this data can be used to threaten individuals or tarnish their reputations, which can in turn impact victims’ mental health, job prospects and livelihoods.
  • Government Requests Leading to Abuses of Freedom of Expression and other Human Rights: For example, where governments demand the company hands over:
    • The communications history of political activists or human rights defenders and use it to identify, intimidate, threaten, detain and even torture them.
    • Data about social media and other online activities of LGBTQI people that is used to violate their right to non-discrimination and rights to liberty and security.
  • Risks to the Right to Non-Discrimination: Where data are used, shared or sold to third parties who use them in algorithmic decision-making that impacts their access to credit, welfare services, insurance or other services. (See Red Flag 5).
  • Operational Costs Following Breaches: Companies that experience a data breach faced immediate financial costs. The Home Depot breach of 56 million customer credit cards was estimated to cost $62 million to enable, among other steps: the post-breach investigation, call center staffing and monitoring of breached accounts for unusual activity. According to IBM’s 2020 Cost of Data Breach report, the global average total cost of a data breach is $3.86 million.
  • Reputational Risk. Loss of Trust: A 2017 Forbes article notes that according to a PwC survey, “only 25% of consumers believe companies handle their personal information responsibly and 87% will take their business to a competitor if they don’t trust a company to handle their data responsibly.” An International Data Corporation study found that “80% of consumers in developed nations will defect from a business because their personally identifiable information is impacted in a security breach.”
  • Stock Price Risk: There have been a number of reports about the impact of high-profile data breaches on company stock prices. The Facebook and Cambridge Analytica scandal of 2018 reportedly led to a $119 billion dollar loss in market value. A UK study notes that, “Companies that self reported their security posture as superior and quickly responded to the breach event recovered their stock value after an average of 7 days. In contrast, companies that had a poor security posture at the time of the data breach and did not respond quickly to the incident experienced a stock price decline that on average lasted more than 90 days.”

*For an explanation of how companies can be involved in human rights impacts, and their related responsibilities, see here.

  • A company can cause an adverse impact on the right to privacy of any stakeholder group that it collects data on, and at any stage of the data lifecycle.
    • When Collecting Data: Although there are arguments that businesses obtain a “conscious compromise” from users about the exchange of information for goods and services, they may cause an impact on the right to privacy if the customer is not “truly aware of what data they are sharing, how and with whom, and to what use they will be put.” (The Right to Privacy in the Digital Age. OHCHR, A/ HRC/27/37).
    • When Holding Data: A company may not have in place adequate security protections such that a human or system error results in personal data being accessible by third parties.
  • A company’s use or mismanagement of data may contribute to a range of human rights harms depending on the context.
    • Where a company suffers a data breach and personal data is accessed by a third party who then uses it to threaten the individuals whose data was leaked.
    • Where a company makes a decision – even if consistent with local law – to provide personal data to a third party where it should have known that the data were likely to be used to abuse the rights of the data subjects concerned.
    • Where companies (for example, banks and IT services firms, or automotive and insurance companies) work together to collect, analyze and interpret data in ways that lead to discriminatory pricing.
    • Where a company sells or in some way shares personal data with business customers who in turn use those data in harmful ways.

  • A company can be linked to a human rights harm where it has sold or provided data to a business entity or government, and that entity uses those data in ways that are unforeseeable but nevertheless lead to adverse impacts on people.

     

Data about individuals can be used to advance a number of SDGs such as those listed below. Addressing impacts to people associated with this red flag can contribute to ensuring that this is done in ways that do not simultaneously increase discrimination, or erode the privacy, reputation and well-being of vulnerable communities.

SDG 10: Reduce Inequality within and Among Countries.

SDG 3: Healthy Lives and Well-Being for all. Including by tackling disruptions to progress such as from the COVID-19 global pandemic.

SDG 5: Achieve gender equality and empower all women and girls, in particular: Target 5.b Enhance the use of enabling technology, in particular information and communications technology, to promote the empowerment of women.

SDG 9: Industries, Innovation and Infrastructure, in particular: Target 9.5 Upgrading industrial sectors; Target 9.b Domestic technological development; and Target 9.c: Access to technology and the internet.

SDG 17: Strengthen the means of implementation and revitalize the global partnership for sustainable development, in particular: Target 17.18 Increasing the availability of high-quality, timely and reliable data disaggregated to achieve development goals.

The UN Secretary-General’s Roadmap for Digital Cooperation is an important resource to guide “all stakeholders to play a role in advancing a safer, more equitable digital world” even as technological solutions are used to achieve the SDGs.

Taking Action /

  • Do we have policies, processes and practices that follow the principle of data minimization such that we only collect or purchase data to the degree that is absolutely necessary to accomplish specific tasks we have in mind?
  • Have we conducted an assessment, and where necessary put in place mitigation plans, for privacy and other risks to people that may arise across the data life cycle including generation, collection, processing, storage, management, analysis and interpretation?
    • Have we done this for all stakeholder groups that may be at risk including employees, contract workers, prospective employees, customers and users?
    • Are we engaging expert groups and potentially affected groups to ensure we understand the risks they perceive or experience?
    • Do we assess whether and how our terms of service or policies for gathering and sharing customer data might increase human rights risks?
  • Do we ensure that customers or users consent to how we gather and use their data, and that their consent is free and informed, including that they:
    • Know that we gather and are in control of data about them.
    • Are informed about how the data will be obtained and held, and for how long.
    • Understand the operations that will be carried out on their data.
  • Know how they can withdraw their consent for the use of their data.
  • Where we buy data from another company, are we confident that it was legally acquired? Do we have ways to verify its accuracy?
  • Where we sell or share data with third parties:
    • Do we assess if they have the appropriate security and safeguards?
    • Do we have in place a data sharing agreement that follows best practice?
  • Do we retain a clear and up-to-date understanding of “data journeys” such that we can, where needed, take meaningful steps to delete the data in the event that we find it is used for human rights abuses?
  • If we transmit data from customer devices, or allow messaging between users, do we have in place end-to-end encryption to prevent third parties from decrypting conversations? Have we developed an approach that takes into account the human rights benefits that can come from allowing third parties to scan for content (such as the ability to support legitimate criminal investigations)?
  • If we face a risk of government demands for data where this may be used to abuse human rights, have we:
  • Are our executives prepared for a breach? Have we done scenario planning and trained all relevant teams about what to do in the event of data breaches? In particular, do we have a clear action plan to ensure we inform our customers or users of breaches as fast as possible?

  • Do we have a comprehensive plan in place to respond to breaches, and specify how we’ll handle informing stakeholders? Are we clear on how we will provide for remedy if our actions contribute to the violation of user, customer, or employee privacy or other rights?

*Mitigation examples are current or historical examples for reference, but do not offer insight into their relative maturity or effectiveness.

  • Privacy Policy Hubs: Several businesses are building “hubs” for their privacy policies. Hubs are a dedicated area where data subjects (visitors to a website, customers, users) can go to view: how their data is being used; where it’s being used; how their data is being collected and what type; terms of the policy; and where subjects can revoke consent.
    • Disney’s privacy hub also states how they protect children – their largest and most at-risk audience.
    • Twitter’s privacy site includes information about how users’ tweets, location, and personal information are used.
  • Cisco’s Trust and Transparency Center Online. In 2015, Cisco launched the Trust and Transparency Center online, which is dedicated to providing information, resources and answers to cybersecurity questions and to help manage security and privacy risk. The Centre includes Cisco’s Trust Principles, which describe their commitment to protect customer, product and company information, and it provides information about security policies and data protection programs.
  • Participation in the Global Network Initiative: GNI is a multi- stakeholder initiative comprising companies, civil society organizations, investors and academics. GNI provides a framework to help ICT companies respect privacy rights, integrate privacy policies and procedures into corporate culture and decision making and communicate privacy practices with users. Members commit to an independent assessment process about how GNI principles are integrated within their organization.
  • T-Mobile Do Not Sell Links: The California Consumer Privacy Act (2018) requires companies to post a clear and conspicuous link on their website that says, “Do Not Sell My Personal Information” through which consumers can opt out of the sale of their data to third parties. Some companies, like T-Mobile, apply this for all customers in the United States.
  • Using Leverage to Regulate Data Brokers: In the United States, some business leaders (most notably Apple CEO Tim Cook) have called for a registry of data brokers to make their role in the collection, storing and selling of personal data more transparent and accountable.

  • The Microsoft Digital Crimes Unit: Microsoft’s digital crimes unit exists to “fight against cybercrime to protect customers and promote trust in Microsoft.” It operates globally through the application of technology, forensics, civil actions, criminal referrals, and public/private partnerships and is staffed by “an international team of attorneys, investigators, data scientists, engineers, analysts and business professionals located in 20 countries.”

  • Consumer Products and Services: A number of companies have launched privacy-oriented alternatives such as:
    • Messaging App Signal: One of the only apps that has its privacy-preserving technology always enabled and ensures that there is never a risk of sharing moments or sending messages to a non-intended recipient. For more on messaging apps see this article.
    • Search Engine Swisscows: Swisscows does not collect any of their visitors’ personal information such as an IP address, browser information, or device information. They do not record or analyze search terms. The only data that Swisscows records is the total number of search requests it receives each day.
  • Enterprise Solutions: A 2020 World Economic Briefing, A New Paradigm for the Business of Data, profiles a small number of Enterprise and consumer solutions that place privacy, user consent and data security at the core. These include:
    • Hewlett Packard Enterprise (HPE) and Continental: HPE and Continental have created the Data Exchange Platform as a marketplace for mobility data. “It provides a secure, transparent, decentralized architecture for trusted vehicle sensor data sharing and payment, based on blockchain technology and smart contracts. It offers data sovereignty and includes a consent- management system for drivers.”
    • Inrupt: “Instead of a company storing siloed snippets of personal data on their servers, users store it in interoperable online data stores giving them unprecedented choices over how their data is shared and used. They can, for example, share their fitness data with their health insurance company, or allow sharing between their thermostat and air conditioner. They can set time limits on sharing and change their choices at any time.”

Citation of research papers and other resources does not constitute an endorsement by Shift of their conclusions.

Dr. Christine Chow /

Board Member

She/Her

Linkedin-in
Dr. Christine Chow has more than 25 years’ experience in investment management spanning sustainable investment, corporate governance, technology and AI.

She has held senior leadership roles at UBS Asset Management, HSBC Asset Management and Federated Hermes, where she led global stewardship, thematic research, responsible investment and engagement with companies on sustainability and governance issues. She was the human rights engagement lead at Federated Hermes, where she pioneered its approach to global value chain engagement with electronics companies, and advocated for provenance and traceability of critical minerals.

Christine served as Managing Director at UBS Asset Management, leading on global stewardship, thematic research and impact engagement. Previously, she was Global Head of Stewardship and a board member of HSBC Asset Management UK Limited, and Head of Asia and Global Technology at Federated Hermes EOS. From 2019 to 2025, she served as a board member and then Chair of the International Corporate Governance Network (ICGN), a global investor-led organisation representing around US$100 trillion in assets under management across more than 40 countries.

Christine is recognised internationally for her work on responsible investment, AI governance and corporate stewardship. She has published influential work on responsible AI and data governance and was a member of the UK Parliament’s All-Party Parliamentary Group on Artificial Intelligence, serving on its Data Governance Task Force. She is the Appointed Advisor of AFRC in Hong Kong, the independent regulator of the accounting profession, and Emeritus Governor of the London School of Economics. Her PhD research on responsible investment was shortlisted for a United Nations award recognising industry relevance and academic excellence.

David Vermijs /

Director

He/Him Amsterdam

Linkedin-in

As Director, David engages with business partners to better identify, prioritize and act on salient human rights issues, embedding the UN Guiding Principles in companies’ decision-making processes.

Specializes in Business Enterprises

As Director, David engages with business partners to better identify, prioritize and act on salient human rights issues, embedding the UN Guiding Principles in companies’ decision-making processes.

David has over a decade of experience advising multinational corporations, governments, NGOs and others on business and human rights. Prior to joining Shift, David provided research assistance to the Special Representative of the UN Secretary-General for business and human rights John Ruggie. As part of his contributions, David field-tested human rights due diligence with a group of Dutch companies and their stakeholders, and he supported research on company-led grievance mechanisms.

From 2008 to 2010, David was the lead consultant on an 18-month project, the Business and Human Rights Initiative, under the umbrella of the Global Compact Network Netherlands. The initiative was a collaboration between 10 Dutch multinationals – ABN AMRO, AkzoNobel, Essent, KLM, Philips, Rabobank, Randstad, Shell, TNT and Unilever – and led to the publication of a ground-breaking business guidance tool, How to Do Business with Respect for Human Rights, in 2010. Through his work at Shift, David led the update of this publication from 2014 to 2016 with the support of the Dutch government under their National Action Plan on implementing the Guiding Principles.

Another major guidance tool David has helped develop addresses due diligence on child labor, published by the International Labour Organization (ILO) and the International Organisation of Employers (IOE) in 2015. The guidance was the result of a multi-year, multi-stakeholder, multi-country project led by David involving the ILO, IOE, companies, unions, NGOs and other stakeholders.

David was previously a Research Fellow at the Corporate Responsibility Initiative at the Harvard Kennedy School, including assisting in teaching on business and human rights, global governance, corporate governance and leadership. David sits in a personal capacity on the board of the Dutch Social and Economic Council International Corporate Social Responsibility Committee. He has a Masters in Public Policy from the Harvard Kennedy School and a Bachelor of Arts in Business from Radboud University Nijmegen in the Netherlands. David is a Dutch national, speaks English and Dutch and is proficient in Spanish and German.

Anna Triponel /

Senior Associate

She/Her London

Linkedin-in

As a Senior Associate with Shift, Anna advises companies, lawyers, investors and business associations on how to put the Guiding Principles into practice.

As a Senior Associate with Shift, Anna advises companies, investors and business associations on how to put the Guiding Principles into practice. Trained as a lawyer, Anna focuses particularly on working with legal professionals on their role in implementing the Guiding Principles and has led work on analyzing regulations in various jurisdictions and how they align to the Guiding Principles. She also has particular expertise on the UN Guiding Principles Reporting Framework. 

Prior to joining Shift, Anna provided input to the work of the Special Representative of the UN Secretary-General for business and human rights John Ruggie as a legal consultant. During this period, Anna also opened the New York office of the Public International Law & Policy Group, where she advised government officials, opposition leaders, human rights victims and civil society organizations on human rights, constitutional reform and transitional justice in Burma, Côte d’Ivoire, Egypt, Kenya, Libya, Somaliland, Tunisia, Uganda and Zimbabwe.

Anna was previously a mergers and acquisitions associate at the law firm of Jones Day in New York, where she advised a broad range of multinational companies on cross-border mergers and acquisitions, joint venture, private equity and venture capital transactions. She founded and led the law firm’s International Law Pro Bono Group. She began her career as an advisor to the World Bank, advising on development governance structures to better meet the Millennium Development Goal of achieving universal primary education.

Anna is a (non-practicing) lawyer qualified in New York, England & Wales and France. She is a frequent expert speaker and writer on business and human rights and is the recipient of various professional awards, including the Empire State Counsel Award for changing the lives of those unable to afford counsel and the Seymour-Reuben Award for shaping international law. Anna has a Masters in International Law from American University Washington College of Law and a degree in common and civil law from the University of Paris X. She has been awarded the Business Sustainability Management certificate from the Cambridge Institute for Sustainability Leadership (CISL) and the MBA Essentials certificate from London School of Economics (LSE). Anna is a British and French national and speaks English and French.

Martyn Platt /

Head of Human Resources

He/Him

As Head of Human Resources, Martyn leads Shift’s global people strategy and oversees all aspects of HR across the organization.

As Head of Human Resources, Martyn leads Shift’s global people strategy and oversees all aspects of HR across the organization. He ensures that Shift’s systems, policies and practices foster a thriving, inclusive and values-driven culture that supports our mission to embed respect for people’s dignity at the core of business practice.

Martyn brings over a decade of HR leadership experience across mission-driven and international organizations working at the intersection of business and society. Prior to joining Shift, he was Director of People Development & Culture at the PRI and earlier worked with Business in the Community. In these roles, he developed and embedded HR business partnering models, guided the organizations through significant growth and transformation, and partnered with senior leaders to design and implement people strategies that supported the delivery of their mission. Most recently, he served as a consultant with the WeProtect Global Alliance, where he supported the establishment of their HR function.

He is a Chartered Member of the CIPD and holds a Level 7 Diploma in Human Resource Management, as well as an ILM Level 7 Certificate in Executive Coaching and Mentoring, reflecting his strong focus on leadership development and coaching. Martyn studied German and International Relations at the University of Exeter, including a year at the University of Würzburg in Germany. He later worked on education projects in Nicaragua, strengthening his global outlook and commitment to people-centred change.

Martyn is based in the United Kingdom.

Brianna Peterson /

Senior Advisor

She/Her Rome

Linkedin-in

As a Senior Advisor at Shift, Brianna advises financial institutions and companies on how to put the UNGPs into practice, with a particular focus on the nexus between human rights and climate change.

Specializes in Financial Institutions

As a Senior Advisor at Shift, Brianna advises financial institutions and companies on how to put the UNGPs into practice, with a particular focus on the nexus between human rights and climate change. Brianna combines environment and climate change expertise with experience developing and implementing human rights policies, due diligence approaches and sustainability reporting.

Before Shift, Brianna spearheaded innovative sustainability initiatives at Sustainable Development Technology Canada and Export Development Canada (EDC). At EDC she led the development and implementation of exciting new portfolio approaches for climate change and human rights risk management, as well as aligning EDC’s corporate reporting with international reporting frameworks, such as the Task Force on Climate-related Financial Disclosures and the UNGPs Reporting Framework.  She also led EDC’s international sustainability negotiations and engagements, including as co-Chair of the Equator Principles Climate Change Working Group.

Prior to joining EDC, Brianna worked for nine years as a diplomat with Canada’s foreign ministry, including four years at the United Nations General Assembly where she led environment and development negotiations, advocacy and outreach on behalf of the Government of Canada, including for the creation of the UN Sustainable Development Goals.

Brianna has also advised international financial institutions including the World Bank Group, institutional investors, bilateral development agencies, and small- and medium-sized enterprises on the practical application of environment, climate change, human rights standards.

Brianna has an undergraduate degree in Chemical Engineering from Queen’s University and a Master’s degree in Environmental Change & Management from the University of Oxford.

Ashleigh Owens /

Director | Financial Institutions Lead

She/Her New York City

Linkedin-in

As Shift’s Director / Financial Institutions Lead, Ashleigh leads our work with financial institutions and supports other partners across industries, leveraging her breadth of experience to tackle cutting-edge issues and entrenched challenges on the road to implementation of the UN Guiding Principles.

Specializes in Financial Institutions | Valuing Respect

As Director / Financial Institutions Lead, Ashleigh engages directly with financial institutions, companies and investors as they embed respect for human rights into their operations and business relationships. She also leads on pieces of research under our Valuing Respect Project, which is focused on developing better ways to evaluate business respect for human rights. Ashleigh has a breadth of experience approaching the Guiding Principles from business, legal and academic perspectives and brings a holistic view to Guiding Principles implementation.

Ashleigh was previously Executive Director at Ernst & Young’s Climate Change and Sustainability Services. At EY Japan, she led a team of consultants supporting policy-making, educational program and governance design, stakeholder dialogue and due diligence strategies for multinational and domestic companies across a variety of industries.  As founder of the EY Human Rights Network, she led the enhancement of EY’s human rights capabilities across EY’s global network. In her role she was a frequent speaker and moderator of dialogues at multi-stakeholder fora and functioned as a connector between civil society, government and corporate actors with a common goal of empowering business to respect rights.

From 2012 to 2014 she conducted research at the United Nations University in the field of Sustainability Science, specializing in business and human rights. She prepared research for the UN Working Group on Business and Human Rights and spent time at the UN Global Compact New York and the Office of the High Commissioner for Human Rights. Ashleigh later sat on the UN Global Compact’s Human Rights and Labour Working Group and drafted the Global Compact’s 2015 Guide on How to Develop a Human Rights Policy.

Ashleigh is a lawyer qualified in Australia and England & Wales and specialized in intellectual property law, labor law and public international law. She has advised governments and companies on state human rights obligations, companies on the nexus between bilateral investment treaties and human rights and fellow lawyers on integrating the Guiding Principles into legal advice. In 2007 she won the Intellectual Property Society of Australia & NZ prize.

Ashleigh has authored or contributed to a number of publications including: Business and Human Rights: Corporate Japan Rises to the Challenge (joint publication between EY Japan and Global Compact Network Japan), Corporate Social Responsibility Can Save Japan (Op-ed in Japan Times), Cumulative Human Rights Impacts (in UN Global Compact/ Maplecroft Business Dilemmas Forum) as well as several legal publications on intellectual property law in Australia and English translations of Japanese High Court judgments. She is also a member of the Advisory Board for the United Nations Institute for Training and Research (UNITAR)’s Division for Prosperity.

Ashleigh has degrees in Law and Asian Studies from the University of Western Australia, with studies also conducted at the University of Vienna and Sophia University in Japan. She has a Masters of Science in Sustainability from the United Nations University and has undertaken the institution’s Leadership for Sustainability program. Ashleigh is an Australian national, and is fluent in Japanese.

Rachel Davis /

Vice President and Co-Founder

She/Her Sydney

Linkedin-in

As the Vice President and Co-Founder of Shift, Rachel helps shape our strategy and oversees a range of our collaborations with companies, governments, investors, civil society and other partners. Rachel is also responsible for driving our work on standards advocacy and with sports associations.

Specializes in Standard Setters | Sports and Human Rights

Rachel is one of Shift’s co-founders and has led work at Shift over the last decade on standard-setting, human rights and sports, financial institutions, conflict and international law.

As Vice President, Rachel shapes our strategy and oversees a range of our collaborations with companies, governments, investors, civil society and other partners. Rachel leads Shift’s work to influence standard-setters of all kinds to integrate the UN Guiding Principles into the rules that govern business, including engaging with governments and the European Union on mandatory human rights due diligence.

Rachel also has unique experience advising and leading efforts to drive respect for human rights into the operations of global sports governing bodies. Rachel was the Chair of FIFA’s independent Human Rights Advisory Board while it operated, between 2017 and 2021. She has advised the International Olympic Committee on human rights since 2018, including co-authoring recommendations for the IOC on a comprehensive human rights strategy with former UN High Commissioner for Human Rights, Zeid Ra’ad Al-Hussein.

Rachel has more than a decade of experience in implementing the Guiding Principles with a wide range of organizations, including public and private financial institutions and companies from diverse business sectors and geographies, and she frequently leads and facilitates engagements with senior audiences around the world. She is the co-author of the leading study of the costs of company-community conflict in the extractive sector.

Prior to co-founding Shift, Rachel was a senior legal advisor from 2006-2011 to the Special Representative of the UN Secretary-General on business and human rights, Harvard Professor John Ruggie. She played a pivotal role in the development of the Guiding Principles, advising on all aspects of the relationship between the Guiding Principles and national and international law.

Rachel is also a Senior Program Fellow with the Corporate Responsibility Initiative at Harvard Kennedy School and has experience at the highest levels of the Australian legal system and internationally, having clerked at the High Court of Australia and at the UN International Criminal Tribunal for the former Yugoslavia in The Hague. She has a particular interest in Indigenous peoples’ rights, having advised the Australian Federal Attorney-General’s Department on Indigenous affairs and acted as Ruggie’s liaison with the UN Permanent Forum on Indigenous Issues during his UN mandate.

Rachel has a Master of Laws degree from Harvard Law School and Bachelors degrees in Law and Politics from the University of New South Wales in Sydney, where she also lectured and published in law. She is a (non-practicing) lawyer qualified in New South Wales.

Federico Burlon /

Director

He/Him London

As Director at Shift, Federico engages with business partners to better identify, prioritize and act on salient human rights issues, embedding the UN Guiding Principles in companies’ decision-making processes.

Specializes in Business Enterprises

As Director at Shift, Federico engages with business partners to better identify, prioritize and act on salient human rights issues, embedding the UN Guiding Principles in companies’ decision-making processes.

Prior to joining Shift, Federico was Head of Delivery at Impactt. Federico managed a portfolio of clients, supported by a team of consultants. He led human rights assessment and remediation projects in the construction, energy, food and shipbuilding industries. This resulted in positive outcomes such as the return of passports and reimbursement of recruitment fees to workers and the strengthening of companies’ employment practices. Federico led Impactt’s engagement with the Supreme Committee for Delivery & Legacy in Qatar as external monitor of worker welfare in the construction of venues for the 2022 FIFA World Cup. He also developed Impactt’s Diagnostics community of practice, delivering for clients as well as building internal capacity to execute human rights assessments around the world, with a focus on worker voice.

Prior to Impactt, Federico was a Sustainability Manager at Tesco plc. He contributed to the roll out of Tesco’s ethical trading programme to the goods-not-for-resale value chain. Federico engaged with hundreds of product and services suppliers and internal purchasing and sourcing teams to raise awareness of human rights issues and to prioritise and address the findings from third-party social audits. He also worked on climate change to develop a roadmap to achieve Tesco’s carbon reduction commitments related to direct and supply chain emissions.

In prior roles, Federico worked with a variety of human rights organisations in the United Kingdom and United States.

Federico holds a MSc in Human Rights from the London School of Economics and a BA in Political Science and International Studies from Macalester College, with a focus on human rights law and international migration. He is a United World College Adriatic alumnus and is from Argentina.

Erika George /

Board Member

She/Her

Linkedin-in X-twitter

Erika George is Director of the Tanner Humanities Center and Samuel D. Thurman Professor of Law at the University of Utah. She has conducted leading research and is a passionate advocate for women’s rights, children’s rights, gender equality and environmental justice. 

Professor Erika R. George is the Associate Dean for Equity, Justice, & Engagement, Professor of Law, and Ernest Haddad Faculty Scholar at Boston University School of Law and a leading expert in business and human rights.

Professor George is the author of “Incorporating Rights: Strategies to Advance Corporate Accountability” (Oxford University Press, 2021), which examines the evolution of demands for corporate responsibility to respect international human rights. She was a founding member of the editorial board of the Business and Human Rights Journal (Cambridge University Press) and since 2022  has served on the board of Shift. 

Before joining BU Law in 2024, Professor George spent over two decades at the University of Utah as the Samuel D. Thurman Professor of Law. She directed the Tanner Humanities Center for four years and worked to enhance engagement and expand and diversify audiences for public humanities programs during her tenure. She also advocated for academic freedom and the right to read. Along with the former poet laureate of Utah, she co-founded the PEN America Utah Chapter to protect access to information and prevent censorship. 

Professor George is an elected member of the American Law Institute, an American Bar Foundation fellow, a trustee of Earthjustice, and serves on the Executive Board of the American Bar Association Center for Human Rights.

She is the recipient of numerous awards including the Society of American Law Teachers’ M. Shanara Gilbert Human Rights Award and the Salt Lake City Human Rights Commission Human Rights Award.

Professor George earned her BA with honors from the University of Chicago, a MA in International Relations from the University of Chicago, and a JD from Harvard Law School. She also clerked for Judge William T. Hart of the United States District Court for the Northern District of Illinois. She was a litigation associate at the law firm of Jenner & Block in Chicago before joining Human Rights Watch as a research fellow.

We recorded an interview with Professor George when she joined Shift’s Board in February of 2022. It is available here.

Erika George is Director of the Tanner Humanities Center and Samuel D. Thurman Professor of Law at the University of Utah. Prior to joining the University of Utah, Professor George served as a law clerk and litigation associate at prominent firms in both Illinois and New York. She also worked as a fellow and later consultant at Human Rights Watch, where she conducted investigations in South Africa on women’s rights, children’s rights, violence, the right to education and abuses related to the HIV/AIDS epidemic. She wrote a book-length report, Scared at School: Sexual Violence Against Girls in South African Schools, which received widespread media coverage in South Africa and internationally. She currently serves as special counsel to the Women’s Rights Division of Human Rights Watch.

Her scholarship has appeared in the California Law Review, the Michigan Journal of International Law, the New York University Journal of International Law and Policy, and the annual proceedings of the American Society of International Law.

Professor George has served on the Executive Committee of the U.S. Department of State Public-Private Partnership for Justice Reform in Afghanistan and as a member of the board of the American Civil Liberties Union of Utah. She is an Editor for the blog globaljusticeblog.com.

We recorded an interview with Professor George when she joined Shift’s Board in February of 2022. It is available here.

John Ruggie /

Founding Chair / In Memoriam

John Ruggie is the author of the UN Guiding Principles on Business and Human Rights.

In Memory of John Ruggie

John served as the founding Chair of Shift from 2011 to 2021. He was the Berthold Beitz Research Professor in Human Rights and International Affairs at Harvard’s Kennedy School of Government. He also taught at the Berkeley and San Diego campuses of the University of California, and at Columbia University where he became Dean of the School of International and Public Affairs. From 1997-2001 John served as UN Assistant Secretary-General for Strategic Planning in the cabinet of Kofi Annan; from 2002-2005 as Special Advisor to the Secretary-General for the Global Compact; and from 2005-2011 as Special Representative of the Secretary-General for Business and Human Rights.

A Fellow of the American Academy of Arts & Sciences, he received numerous awards from academic and professional societies for his contributions to social science, public policy and the development of international law. In addition to serving as Shift’s Board Chairman, John was also on the Board of Arabesque Asset Management Holding Company as well as Unilever’s Sustainability Advisory Council. His book, Just Business: Multinational Corporations and Human Rights, has been translated into Chinese, Japanese, Korean, Portuguese and Spanish.

Caroline Rees /

President and Co-Founder

She/Her New York City

Linkedin-in

As Shift’s President, Caroline leads our strategic development and drives our thought leadership work on key challenges and opportunities in advancing corporate respect for business and human rights.

As the President and Co-Founder of Shift, Caroline leads our organizational strategy and development and drives our thought leadership work on key challenges and opportunities in advancing corporate respect for business and human rights. Caroline speaks extensively at events around the world and frequently facilitates dialogue and debate amongst companies, governments, investors and civil society. In recent years, Caroline has focused on improving corporate human rights reporting as a catalyst for better human rights risk management, and on improving the data and methods used in evaluating companies’ social performance as part of ESG (environmental, social and governance) analysis. She has written and spoken extensively on the relevance of business respect for human rights, and the UNGPs specifically, to movements that seek to advance sustainability, equality, ESG investing, stakeholder capitalism, and human and social capital.

Caroline previously spent 14 years with the British Foreign and Commonwealth Office. From 2003 to 2006 she led the UK’s human rights negotiating team at the UN and she ran the negotiations to establish the mandate of the Special Representative of the UN Secretary-General on business and human rights. The success of this initiative led to Professor John Ruggie’s appointment and from 2007-2011 Caroline was a lead advisor on his team and deeply involved in the drafting of the Guiding Principles.

From 2009 to 2011 Caroline was also the Director of the Governance and Accountability Program at the Corporate Social Responsibility Initiative at Harvard Kennedy School and she remains a Senior Program Fellow there. Caroline is a member of the Imperatives Board of the World Business Council for Sustainable Development, the Board of the Capitals Coalition, the Unilever Sustainability Advisory Council, and the Steering Committee of the Taskforce on Inequality and Social-related Financial Disclosures.

Caroline’s prior British foreign service career covered Iran, Slovakia, the UN Security Council in New York and the European Union in Brussels. Caroline has a Bachelor of Arts (Hons) from Oxford University and a Master of Arts in Law and Diplomacy from the Fletcher School of Law and Diplomacy at Tufts University. Caroline is a British national and speaks English, French and German.