For years, remedy has occupied an uneasy and marginal position within OECD National Contact Point for Responsible Business Conduct (NCP) non-judicial grievance mechanism. While the OECD Guidelines for Multinational Enterprises are aligned with the UN Guiding Principles on Business and Human Rights (UNGPs), including their third pillar on access to remedy, NCP outcomes have rarely engaged with remedy in a substantive way. Across more than 400 human rights–related specific instances, references to remedy have been sparse, underdeveloped, with NCPs tending to prioritise dialogue, and forward-looking recommendations while leaving past or ongoing harms insufficiently addressed.
The Norwegian NCP’s Final Statement in SOMO, the Centre for Research on Multinational Corporations (on behalf of 474 Myanmar civil society organisations (CSOs)) against Telenor ASA, issued in December 2025, marks a clear departure from this pattern. The decision confirms that Telenor breached international standards by failing both to respect human rights and to conduct adequate human rights due diligence (HRDD) before, during, and after its disengagement from Myanmar, and it stands out as one of the rare instances to directly confront corporate responsibility to remedy the actual harm, articulates when such responsibility arises, and articulate what remediation may entail in a high-risk context.
Disengagement and corporate responsibility
The case arose from Telenor’s disengagement from Myanmar following the military coup of 1 February 2021. Telenor, a majority state-owned Norwegian telecommunications company, had operated in Myanmar since 2014, serving approximately 18 million customers. After the coup, the military junta expanded surveillance powers, and intensified requests for user data, placing telecommunications operators at the centre of an acute human rights risks and creating a foreseeable and severe risk that customer data could be used to identify, and persecute political opponents.
In July 2021, SOMO filed a complaint before the Norwegian NCP, alleging that Telenor failed to observe the OECD Guidelines in its disengagement, particularly regarding disclosure, risk-based due diligence, and stakeholder engagement. Central to the complaint was the sale of Telenor Myanmar to the Lebanese investment group M1, combined with requirements of majority local ownership reportedly linked to military-aligned actors, which allegedly heightened risks to end users and civil society.
The NCP accepted the complaint and facilitated a lengthy mediation process. Although the mediation did not culminate in a full agreement, it produced interim outcomes, including a Memorandum of Understanding (MoU), an independent ICT Ecosystem Study, and discussions on a potential Myanmar Digital Security Relief Mechanism. When Telenor refused to engage substantively with proposals concerning its contribution to a such mechanism, NCP proceeded to issue a Final Statement addressing whether Telenor had conducted HRDD during its exit, and whether—and how—it should contribute to remediation (para 4).
Affirming Remedial Responsibility Beyond Exit
What distinguishes this Final Statement is its significant determination on corporate HRDD in high-risk, conflict-affected areas, it goes further by articulating Telenor’s remedial responsibility for the actual harms. While acknowledging the exceptional constraints under which Telenor operated, including security risks and pressure from the military junta—the NCP concluded that Telenor ‘may have’ contributed to adverse human rights impacts through the manner of its exit (para 133). in particular, the provision of user data to a abusive regime, without effective risk mitigation measures, could amount to contribution rather than mere linkage. Although the NCP stops short of a definitive finding of contribution, this conclusion is nonetheless significant, as NCPs have traditionally been reluctant to characterise corporate conduct as contribution rather than mere linkage to human rights harms.
Significantly, the NCP clarified that it was unnecessary to determine Telenor’s exact position on the continuum between contribution and linkage. Regardless of classification, the company retains a responsibility to provide or participate in remediation and to use its leverage to ensure that harm was addressed (para. 135). The NCP therefore recommended that Telenor actively contribute to remediation by supporting the development and implementation of a Myanmar digital security relief mechanism, including through financial and other forms of assistance aimed at to citizens exposed to risks linked to their digital footprint.
Remedy Reframed: The Myanmar Digital Security Relief Mechanism
The Final Statement reframes remedy not as one-off compensation but as a constellation of measures addressing ongoing and systemic risks. Referring to the ICT Ecosystem Study, the it identifies remediation as including financial support, leverage, capacity-building, risk mitigation, and multi-stakeholder cooperation ( para 36 and 37).
This approach is most clearly reflected in the NCP’s recommendations to establish a Myanmar Digital Security Relief Mechanism, to support individuals and groups facing heightened risks linked to their digital footprints, including CSOs, human rights defenders, and journalists. Importantly, the NCP treated this mechanism not as voluntary corporate philanthropy but as part of Telenor’s remedial responsibility. The Norwegian NCP also stressed that remediation in this context is necessarily collective. Telenor is expected to cooperate with CSOs, ICT companies, and regional stakeholders to support durable, meaningful solutions (paras 135 and 150). This ecosystem-based understanding of remedy acknowledges that digital harms arise through complex constellations of actors and technologies, requires shared responsibility.
Implications for NCP Practice
The broader implications of this decision are difficult to overstate. The Norwegian NCP demonstrated that NCPs could articulate substantive remedial expectations within their non-judicial mandate, challenging the long-standing tendency to treat remedy as peripheral within the NCP system. The decision also sends a clear signal: a responsible exit does not amount to a responsibility-free exit. At the same time, the case exposes the persistent limits of NCP practice. Despite the NCP’s findings, victims continue to pursue justice through litigation and parliamentary scrutiny. Corporate responses remain largely forward-looking, highlighting the persistent gap between remedial expectations and their realisation.
Nonetheless, this case offers one of the clearest examples to date of how the remedial responsibility can be operationalised within the OECD Guidelines. It narrows the gap between principle and practice and provides a concrete reference point for future NCPs. Remedy need not remain the missing pillar of NCP practice where institutional willingness exists, it can be articulated, operationalised, and positioned at the centre of responsible business conduct.
