BSR | Human Rights Impact Assessment: Facebook in Myanmar 43 the founder, chairman and chief executive officer and chief operating officer. being addressed, business enterprises should track the effectiveness of their response.” Rather than duplicate these existing structures, BSR proposes that enough resources (budget, people, time, formal terms of reference) be allocated to ensuring that the human rights management and mitigation plans arising from this and other HRIAs (see section 7.2) are implemented, reviewed, and tracked by relevant Facebook decision-makers, forums, and committees. In short, we are recommending integration into existing processes, rather than the creation of a parallel structure. Principle 17(c) of the UNGPs states that human rights due diligence “should be ongoing, recognizing that the human rights risks may change over time as the business enterprise’s operations and operating context evolve.” This should include ensuring that human rights impacts of material importance to business success are communicated to the Facebook Board and Audit and Risk Oversight Committee. Facebook should periodically review the contents of this HRIA, taking into consideration any material changes in the local context or Facebook’s product and service mix. Publish periodic human rights updates to the public. These communications could take a variety of forms. For example, Facebook could establish a dedicated human rights website as a “home” to this and other HRIAs, provide regular updates on progress, or publish a formal annual human rights report. Continue to undertake similar HRIAs in other highrisk markets. Facebook can develop a more robust and systematic approach to human rights by undertaking HRIAs in other high-risk markets. BSR notes that Facebook has already initiated HRIAs in several other countries and has plans in place to grow that number. GNI Implementation Guideline 2.7(f) states that companies should “update human rights impact assessments over time, such as when there are material changes to laws, regulations, markets, products, and services.” GNI Implementation Guideline 2.3 states that companies should review freedom of expression and privacy risks related to the company’s operations in a manner consistent with the company’s overall approach to risk management. Principle 21 of the UNGPs states that companies should communicate how they address human rights impacts externally. GNI Implementation Guideline 5.4 states that participating companies should communicate their general approach to addressing their human rights impacts in relation to freedom of expression and privacy, such as via public communications or formal reporting. Principle 17 of the UNGPs states that “in order to identify, prevent, mitigate and account for how they address their adverse human rights impacts, business enterprises should carry out human rights due diligence.” Principle 17 of the UNGPs also states that “where business enterprises have large numbers of entities in their value chains it may be unreasonably difficult to conduct due diligence for adverse human rights impacts across them all. … Business enterprises should identify general areas where the risk of adverse human rights impacts is most significant … and prioritize these for human rights due diligence.”