Ready for Supply Chain’s General Data Protection Regulations?

The E.U. General Data Protection Regulation

The E.U. General Data Protection Regulation (GDPR) was passed into law in 2016 and represented the broadest approach to codifying individuals' rights to protect their personal data.

Specifically, the legislation outlined the rights that individuals had concerning how business entities worldwide use, protect, and share personal information.

The GDPR legislation brought about broad-reaching implications that spanned the globe, as the law made no exception for a business's location. If a company offered goods, services, or merely processed personal data of an E.U. citizen, those actions needed to conform to the law. The reach of GDPR was so widespread in fact, that you personally have likely participated in employer-mandated GDPR compliance training.

While GDPR was concerned with managing and safeguarding personal data, new legislation is emerging within the E.U. that centers around human rights and transparency in the supply chain. We should expect that any new law that passes will have global repercussions and require end-to-end supply chain audits. There will be significant financial penalties for those who do not conform to the law and massive consumer backlash on reported violations.

Emerging E.U. Legislative Action

The E.U. legislation seeks to define corporations' obligations to address and remove human rights violations from their global supply chains. The E.U.'s pending legislation is not the first of its kind. There is a push to hold companies directly accountable for removing human rights violations, addressing destructive climate practices, and legislating processes regarding conflict minerals.

Here are some sample legislations from E.U. member countries:

• E.U.'s 2013 Timber and 2017 Conflict Mineral regulations
• U.K.'s 2015 Modern Slavery legislation
• France's 2017 “duty of vigilance of parent and ordering companies”
• Germany’s 2021 Supply Chain Act (Lieferkettengesetz)

The E.U. legislation stands to add nth degree accountability with substantial penalties, regardless of where they occur within the global supply chain. C-suite leaders should take notice and start now to ensure that their supply chains are free of forced child labor and have continuous, transparent processes related to how they secure conflict minerals - not convinced?

The GDPR outlined a maximum fine of 4% of global revenues and demonstrated that it has teeth, too, as both Google and H&M received additional fines in 2020 that was on top of previous fines that started rolling out immediately in 2019.

While the E.U. is at the front of this push, last year, the United States Congress saw the introduction of the Slave-Free Business Certification Act legislation. While this stalled out in recesses, there is a strong indication that this topic will be picked back up in the current cycle, and we will see international commitment.

Supply Chains Lack Transparency

A few general themes have emerged, and they focus on the requirement of a company to be aware of supply chain compliance, transparency, and correction of the aforementioned areas in their suppliers and their supplier's suppliers. There has been criticism that German law has capped auditing at the first supplier, often an E.U. wholesaler, while poor behaviors that occur overseas lay beyond the law's scope. The minimum workforce size additionally creates an exemption for roughly 60% of German businesses. The E.U. law is expected to remove those exemptions and extend responsibility to the lowest components, even covering packaging and raw materials.

The E.U. corporation will ultimately be responsible for the goods and materials in their supply chains. Because international supply chains are complex, we will see delegated reporting requirements. Each tier will be responsible for the next tier in the supply chain and be required to maintain those audits. Agriculture and textile supply chains have rightly borne scrutiny over the years as their costs are disproportionately shouldered by poorer countries. Historically, these industries have had rampant abuses in both human rights as well environmental impacts. Fortunately, the earlier timber and conflict mineral regulations removed the defense of “out of sight, out of mind” ignorance on these practices.

This legislation impacts companies regardless of where they are located - if they sell to or service E.U. corporations, they will need to comply with the laws. Much in the same way that non-E.U. entities were required to adhere to GDPR, international supply chains will be required to conform. Every supply chain can expect transparency to become the message of the day. “We didn't know” is not going to protect from a fine being levied.

First Mover Necessity

We are in the early days, and the E.U. is still actively researching how they want to craft their law. The consensus is that we will see an amalgamation of the previous approaches with the standard 3-year grace period. As this period will pass quickly, companies must act immediately, or even before the legislation is passed to add the reporting and transparency oversight outlined in earlier focused legislation.

Expect a “land grab” as companies seek to exit high-risk suppliers and secure capacity with partners that have demonstrated integrity and transparency. Inevitably, contractual commitments will rule the day - those that wait can find themselves having to take on higher degrees of vertical integration as compliant suppliers are capacity constrained.

Some companies may even be forced to exit spaces entirely as they choose between risky business or no business. Conversely, early collaboration can help avoid price hikes as desirable suppliers either add additional compliance policies or charge a premium for their prior diligence. Moving slowly here can become a costly mistake to business continuity, brand reputation, and supply chain disruption with no expeditious solution.

One recent example highlights the ramifications and the need for this legislation. In Summer 2020, U.K. fashion producer Boohoo was accused of modern slavery. Its business has not recovered and even if they correct their unsavory business practices, the brand damage has been done. No corporation wants to find itself in the court of public opinion regarding human rights violations, ecological devastation, or the use of conflict minerals.

Search SC24/7 on “Human Rights and Transparency in the Supply Chain”

Companies that are considering their next move should take note that studies have shown consumers willing to pay a 25% premium for brands that take positive, proactive actions regarding green and sustainable initiatives. While this regulation can be broad and intimidating, the rewards can be equally vast if leveraged strategically.

Complying with and Maintaining Changes

Managing this alone is a complex lift for a company of any size. Partnering with a technology solution provider can immediately reduce the friction of complying with and maintaining these changes. Coupa delivers an integrated cloud solution with necessary features such as:

• Risk and Performance Management based on a combination of public information and Community Intelligence sourced from over $2T in annual spend managed on the platform.
• Supplier Information Management allowing for self-declaration as well as tying financial transactions to the maintenance and submission of compliance documents, so you always know who you are doing business with.
• Sourcing Optimization allows you to strategically award your business based on a blend of non-financial and financial metrics ensuring a balance of cost and risk sensitivity.
• Supply Chain Design and Planning to perform continuous modeling of international supply chains and prescribe alternate flows when adding or removing suppliers from your portfolio.
• Changing this from a procedurally cumbersome compliance process to a competitive advantage is attainable when you work with the recognized leader in business spend management.

To gain deeper insights into the usage of supply chain modeling to improve the effectiveness of risk and resiliency analysis, and to mitigate the risk implications in your supply chain, download this complimentary whitepaper: Risk, Resiliency, and Supply Chain Modeling.

Related Resources

Risk, Resiliency, and Supply Chain Modeling
This paper first examines why existing supply chain management practices do not naturally develop resilient supply chains and why some of the existing supply chain processes are not suitable for addressing such risks and required responses. Download Now!

---

Gartner Hype Cycle for Supply Chain Planning Technologies
According to Gartner, “SCP (supply chain planning) is a well-established technology market, but SCP is being redefined by drivers such as digitization, supply chain disruptions and volatility.” Download Now!

---

Digital Supply Chain’s Evolving Role in the Enterprise Agenda
The Hackett Group 2020 Key Issues Study findings confirm that the mantra of “doing more with less” is still prevalent, but the top concern of supply chain leadership is that their organizations are in fact overcommitted, AI analytics to enable a more agile supply chain. Download Now!

---

Global Supply Chains in a Post-Pandemic World
In this webinar summary, Willy Shih, Robert and Jane Cizik Professor of Management Practice in Business Administration at Harvard Business School, shares insights into how global supply chains came to be the way they are and how their vulnerability has been revealed through numerous crises. Download Now!

---

More Resources from Coupa

Related Article: 9 Ways to Improve Supply Chain Resiliency in Response to Executive Order on America’s Supply Chains