Canada’s National Contact Point Final Statement – Justice Beyond Borders / Justice for Iran and Genetec

May 5, 2025

Summary

1. On December 18, 2024, Canada’s NCP received a request for review from Justice Beyond Borders / Justice for Iran (JBB/JFI) (the “Notifier”). The request for review concerned observance of the OECD Guidelines by Genetec (the “Respondent”), a Montreal-based company with global operations serving customers in over 150 countries.
2. JBB/JFI alleged that Genetec’s “Security Center”, a comprehensive security management platform that integrates video surveillance, access control, and automatic licence plate recognition, was being sold through Iran-based channel partners and distributors to end-users in the Islamic Republic of Iran and ultimately enabling Iranian government entities to cause adverse impacts on human rights.
3. The Notifier claimed that making its products available in Iran implicated Genetec’s observance of guidelines around due diligence in Chapters II (General Policies) and Chapter IV (Human Rights). The Notifier asked the NCP to give further consideration to these issues.
4. As part of the NCP’s initial assessment, the NCP secretariat held separate conversations and had several email exchanges with both parties. Written submissions provided to the NCP by one party were shared with the other party.
5. The NCP concluded that the issue raised in relation to the alleged ongoing sale of Genetec products in Iran did not warrant further consideration and an offer to facilitate dialogue or mediation between the parties. The Respondent categorically denied having business relationships with channel partners in Iran and stated that any entities identified by the Notifier were misrepresenting themselves as current providers of Genetec products in Iran. The Respondent stated that it had stopped serving the Iranian market in 2018.
6. Based on the available information, the NCP did accept for further consideration the issue raised regarding the Respondent’s approach to Chapter IV, paragraph 4 of the Guidelines (“have a publicly available policy commitment to respect human rights”) and has made recommendations to the Respondent.  
7. Given the exchange of information between the parties facilitated during the initial assessment phase, and as neither party sought dialogue or mediation, the NCP did not facilitate further engagement under its good offices. The NCP will follow-up with the parties about its recommendation six months from publication of this Final Statement.  
8. Both the Notifier and Respondent were given the opportunity to review and provide comments on this Final Statement prior to its publication.
9. The NCP emphasizes that this Final Statement does not make any determination as to whether the Respondent has observed the Guidelines. This Final Statement should not be seen as validating to any degree – one way or the other – claims made by either the Notifier or Respondent.

Substance of the submission  

10. JBB / JFI is a United Kingdom-based non-governmental organization established in 2010. Its stated aim is to “hold the perpetrators of serious human rights violations…which have been committed by Iran or by Iranian officials, accountable.” At the time of filing its submission, JFI was in the process of merging with JBB, which works globally to provide free legal support to victims of human rights abuses and to ensure accountability for perpetrators.
11. The Respondent, Genetec, is a privately owned technology company established in 1997 in Montreal. It specializes in security solutions for businesses and governments, and develops both software and hardware for video surveillance, access control, and licence plate recognition.
12. Genetec’s “Security Center” is a unified software platform that integrates multiple security systems, allowing organizations to monitor and manage their security operations more efficiently. According to Genetec’s website, the company serves sectors such as law enforcement, transportation, retail, and critical infrastructure. In its 2023 annual report published further to the Fighting Against Forced Labour and Child Labour in Supply Chains Act, Genetec reported having “offices in many countries around the world” and serving 42,500 customers in over 159 countries.

Notifier’s Position

13. The Notifier informed the NCP that its researchers had identified three Iran-based companies purporting to be “channel partners” or distributors of Genetec products in Iran as of December 2024. The Notifier further claimed that these companies conducted projects for the Iranian government and that the Security Center product had therefore potentially been made available to Iran’s “security apparatuses to monitor and suppress any form of dissent in the country among its own citizens”.
14. On this basis, the Notifier raised concerns about the Respondent’s observance of the Guidelines’ recommendations on respecting human rights and undertaking human rights due diligence (Chapter IV, paragraphs 1, 2, 3 and 5). The Notifier also claimed that Genetec did not have a publicly available statement of policy expressing its commitment to respect human rights (Chapter IV, paragraph 4).
15. The Notifier had not previously approached Genetec regarding the issues raised in its claim, citing concerns about maintaining the anonymity and safety of its researchers. The Notifier asked the NCP to further examine these issues. The Notifier informed the NCP that it was not interested in a facilitated dialogue or mediation with the Respondent but was open to the NCP facilitating an exchange of information during the initial assessment.

Respondent’s position

16. According to the Respondent, the company stopped selling hardware products to buyers in Iran in 2014 and stopped selling/servicing software products in the country in 2018. The Respondent told the NCP that its decision to cease doing business in Iran was made despite it having a legal right to continue selling its products in Iran.
17. The Respondent informed the NCP that it does not have any active agreements with channel partners in Iran and that none of its current channel partners are servicing the country. The Respondent maintained that the alleged channel partners cited by the Notifier were not authorized partners of Genetec. The Respondent said that it was aware that certain companies in Iran were misrepresenting themselves as authorized suppliers of Genetec products and illegally using Genetec’s name and image to attract customers. The Respondent informed the NCP of the fact that certain companies in Iran are selling counterfeit copies of Genetec products in Iran.
18. The Respondent said that Genetec is a company that seeks to promote and embody strong values and principles of responsible business conduct. The Respondent referred the NCP to the company's Corporate Social Responsibility webpage for more information on the company’s approach. Among other things, this page includes links to Genetec’s reporting made pursuant to requirements of Canada’s Fighting Against Forced Labour and Child Labour in Supply Chains Act, and the UK Modern Slavery Act. These statements detail the company's policies, due diligence processes, and training initiatives aimed at identifying and mitigating risks associated with forced labour and child labour.
19. The Respondent emphasized that it ensures its exports comply with all applicable Canadian export control laws and that the company remains vigilant regarding its compliance with applicable export controls and trade restrictions. The Respondent explained that Genetec has an internal Export Controls and Trade Compliance function mandated to ensure compliance and conduct internal audits.

Initial Assessment

20. The NCP conducted an initial assessment based on the information supplied by the Notifier and the Respondent, as well as publicly available information. In making this initial assessment, the NCP considered the following:
    • the identity of the party concerned and its interest in the matter;
    • whether the issue(s) were material and substantiated;
    • whether there seemed to be a link between the enterprise’s activities and the issue(s) raised in the specific instance;
    • the relevance of applicable law and procedures, including court rulings;
    • whether further consideration of the issue(s) would contribute to the purposes and effectiveness of the Guidelines.
21. It should be emphasized that the NCP is not positioned to conduct in-depth independent fact-finding and typically relies on information provided by the parties and on available public information in conducting its initial assessment. The NCP’s initial assessment does not represent a determination as to whether the Respondent observed the Guidelines. This initial assessment should not be seen as validating to any degree – one way or the other – claims made by either the Notifier or Respondent.

Identity of the party concerned and its interest in the matter

22. The Notifier is an organization with a mandate and history of activity related to promoting respect for human rights in Iran. The Notifier appeared to have a sufficiently direct interest in the matter raised.

Whether the issue is material and substantiated

23. In assessing whether the issues raised are “material”, the question is whether the issues raised have clear and meaningful relevance to the Guidelines. In assessing “substantiation”, the question is whether the issues raised are based on sufficient and credible information.
24. The NCP’s initial assessment in no way asserts that events occurred in the way alleged by the Notifier, nor is it a determination as to whether the Respondent observed the Guidelines.

Alleged contribution or direct link to adverse human rights impacts caused by Iranian government entities

25. The Notifier claimed that the Respondent’s Security Center product was being made available in Iran and enabling Iranian government entities to cause adverse impacts on human rights, namely by monitoring and suppressing any form of dissent. The Notifier questioned whether Genetec was fulfilling recommendations in Chapter II (General Policies) paragraphs 2, 11, and 12, and Chapter IV (Human Rights), paragraphs 1, 2, 3, and 5.
26. The issue as to whether the Respondent had observed the Guidelines’ recommendations on respect for human rights and human rights due diligence in the alleged commercial activities is material to the Guidelines.
27. In its submission, the Notifier provided background information on the human rights situation in Iran and the role of surveillance technology powered by artificial intelligence in enabling and exacerbating violations of human rights by the Iranian government.
28. The Notifier submitted weblinks and screen captures of the online websites of two Iran-based companies. These images appeared to show these companies advertising Genetec products as available for order. One company’s website had advertisements for three add-on features for Genetec’s Security Center: Mission Control, a software solution designed for incident management; Clearance, a cloud-based digital evidence storage; and Traffic Sense, a traffic management software.
29. One company’s website also showed two “Official Partner” certifications for “authorization of the sale and support of a full range of Genetec’s products”, though both certifications appeared to have expired. The website of the same company also showed certifications issued to four employees for Genetec’s Omnicast, Synergis and Enterprises software technical support. However, the dates on these certification documents indicated that they had expired. The NCP was unable to verify the existence of advertisements for Genetec products on the second company website.
30. After filing the request for review, the Notifier also submitted a video recording of the website of a third company. This appeared to show an advertisement for Genetec products. The NCP’s open-source research did not yield any further information on the company.
31. The Respondent stated that none of these entities were authorized channel partners or distributors of Genetec products and emphasized that it had ceased selling to / servicing the Iranian market in 2018. The Respondent also noted that the Genetec certification document reproduced in the Notifier’s submission had been issued in 2017 and expired in 2019.
32. The NCP did not receive information from the Notifier as to whether the three companies were providers of products or services to Iranian government entities or indicating that Genetec products were involved in state-sponsored projects that may have resulted in adverse human impacts in Iran.
33. The NCP did not see the issue sufficiently substantiated for further consideration.

Respondent’s approach to Chapter IV, paragraph 4

34. Chapter IV, paragraph 4 calls on enterprises to “have a publicly available policy commitment to respect human rights”. The Notifier claimed it could find no such policy commitment articulated in the Respondent’s publicly available policies and documents.
35. The issue of whether the Respondent has such a policy commitment is material to the Guidelines.
36. The NCP reviewed publicly available materials on the Respondent's website to better understand how the company's commitment to respect human rights is articulated and reflected in its corporate policies. The NCP invited the Respondent to provide additional information on the company’s policy commitment in this regard.
37. The Respondent’s website describes several initiatives and commitments speaking to responsible and ethical conduct in the provision of security technology. Respect for human rights is referred to in several documents and policies listed on its website. For example:
    • Annual reporting on addressing forced labour: Genetec’s 2023 report made pursuant to the Fighting Against Forced Labour and Child Labour in Supply Chains Act speaks to “[Genetec’s] commitment to the defence of human rights” and an expectation for each of its “business partners and suppliers to share [Genetec’s] commitment to respect human rights and equality of opportunity in the workplace”. The report describes actions taken by Genetec to assess and manage risks of forced labour and child labour.
    • Software License Agreement: In paragraph 2(c) of its Software License Agreement, Genetec requires that its software be used in an ethical and responsible manner, in compliance with the United Nations Universal Declaration of Human Rights:
      Licensee further warrants that it will use Software in an ethical and responsible manner, in compliance with the Universal Declaration of Human Rights of the United Nations and other applicable legislation combatting modern slavery practices or other violations of human rights, including those pertaining to discrimination and harassment.
      • Data Protection and Privacy: Genetec emphasizes the importance of respecting individuals' rights to their own data, including rights to access, rectification, and erasure, highlighting its commitment to data protection and privacy.
      • Responsible AI Practices: The company integrates artificial intelligence across several of its products, particularly in the areas of video surveillance, security, and traffic management. Through its Trust Center, Genetec outlines its commitment to responsible AI, detailing strict guidelines for creating and maintaining AI models with a focus on privacy and data protection, as well as societal impact.
38. Several of these policies, statements, and activities appeared to reflect a policy commitment to respect human rights. However, the NCP was not made aware of any comprehensive or consolidated standalone human rights policy elaborating on this commitment in greater detail.
39. The NCP found this issue sufficiently substantiated to merit further consideration. This does not represent a finding that the Respondent acted inconsistently with the Guidelines. Rather, it simply means that the information available to the NCP indicated a reasonable basis for the NCP to consider the issue further as part of the specific instance process.

Whether there seemed to be a link between the enterprise’s activities and the issue raised in the specific instance

40. In light of the Respondent’s stated decision to stop selling / servicing its software products in Iran in 2018, and its categorical denial of having business relationships with the entities cited by the Notifier, it was difficult to see a link between the enterprise’s current activities and the adverse impacts on human rights in Iran claimed by the Notifier.

The relevance of applicable law and procedures, including court rulings

41. Neither of the parties indicated the existence of parallel proceedings or applicable laws that are relevant to this specific instance.
42. In its submission to the NCP, the Notifier referred to the Export and Import Permits Act and the Special Economic Measures Act and associated regulations. However, the Notifier’s submission did not allege that the Respondent had failed to comply with any legal requirements of these acts and regulations. It was unclear to the NCP what bearing this general information was supposed to have on its assessment regarding the OECD Guidelines.
43. As noted above, the Respondent stated that it ensures its exports comply with all applicable Canadian export control laws and that it is vigilant regarding compliance with applicable export controls and trade restrictions.

Whether further consideration of the issues would contribute to the purposes and effectiveness of the Guidelines.

44. The NCP did not see further examination of the issue contributing to the purposes and effectiveness of the Guidelines. In this respect, the NCP took into account the Respondent’s statement that it had stopped selling hardware products in Iran in 2014 and stopped selling software products in Iran in 2018, as well as its denial of having any active business relationships with Iran-based companies, including those identified by the Notifier.
45. As noted above, while the Respondent refers to a commitment to respect human rights in several corporate documents publicly available on its website, the NCP was not made aware of any publicly available consolidated policy statement outlining the Respondent’s commitment in greater detail. Giving further consideration to this issue appeared to hold potential to help reinforce the Respondent’s approach to this recommendation from the Guidelines, and therefore to their purposes and effectiveness.

Conclusion

46. Given the nature of the issue accepted for further consideration, and as neither party sought a facilitated dialogue or mediation, the NCP did not facilitate further engagement between the parties under its good offices. The exchange of documents facilitated by the NCP as part of the initial assessment phase had allowed both parties to share relevant information and perspectives.
47. Further to its initial assessment, the NCP gave further consideration to the issue raised regarding the Respondent’s approach to paragraph 4 of Chapter IV and has issued a recommendation.

Recommendation

48. The NCP recommends that Genetec consider elaborating and articulating its policy commitment to respect human rights in a single, publicly available policy document. The NCP recommends that the Respondent draw on the recommendations in OECD Guidelines Chapter IV Human Rights, paragraph 4, and the accompanying commentary paragraph 49, reproduced below:
    
    49. Paragraph 4 recommends that enterprises express their commitment to respect human rights through a publicly available statement of policy that is: (i) approved at the most senior level of the enterprise; (ii) informed by relevant internal and/or external expertise; (iii) stipulates the enterprise’s human rights expectations of personnel, business partners and other parties directly linked to its operations, products or services; (iv) communicated internally and externally to all personnel, business partners and other relevant parties; (v) reflected in operational policies and procedures necessary to embed it throughout the enterprise.
49. The NCP is of the view that addressing this recommendation could help Genetec build further on its current approach to responsible business conduct, and reinforce to customers, partners, and stakeholders its existing commitments in this regard.
50. The NCP also encourages Genetec to consider publishing more information about how its policy commitment to respect human rights is implemented through human rights due diligence. The NCP is of the view that this could help the Respondent reinforce its approach to Chapter IV, paragraph 5. The NCP notes that the process of carrying out human rights due diligence entails not only assessing actual and potential human rights impacts but also communicating about how they are addressed.
    
    Paragraph 5 recommends that enterprises carry out human rights due diligence. The process entails assessing actual and potential human rights impacts, integrating and acting upon the findings, tracking responses as well as communicating how impacts are addressed. Human rights due diligence can be included within broader enterprise risk management systems, provided that it goes beyond simply identifying and managing material risks to the enterprise itself to include the risks to rights-holders. It is an on-going exercise, recognising that human rights risks may change over time as the enterprise’s operations and operating context evolve. Complementary guidance on due diligence, including in relation to supply chains, and appropriate responses to risks arising in supply chains are provided under paragraphs A.11 to A.13 of the Chapter on General Policies and their Commentaries. In addition, further guidance has been developed for specific sectors and risk issues, as well as at a cross-sectoral level through the OECD Due Diligence Guidance on Responsible Business Conduct. Conducting human rights due diligence may involve considering distinct and intersecting risks, including those related to individual characteristics or to vulnerable or marginalised groups. Meaningful stakeholder engagement is important in this regard and considering ways to maximise sustainable development outcomes for such groups may also be relevant.
51. The NCP will follow up with the parties six months from the publication of this Final Statement about the recommendation and will describe the outcomes of its follow-up in a published statement.
52. It should be stressed that the NCP’s Final Statement in no way asserts whether claims made by the Notifier are true, nor is it a determination as to whether the Respondent observed the Guidelines in this specific instance.