Only halfway through 2024, California employers – who are no strangers to change – have already felt the impact of several developments this year, ranging from the now-effective changes under the Workplace Violence Prevention Plan law, Cal/OSHA’s indoor heat illness prevention standard, and PAGA reform to the soon-to-be effective changes under Los Angeles County’s Fair Chance Ordinance, all of which are discussed in our recent eAlert HERE.
In a welcome change of pace, this article deviates from the endless updates and offers insight into recently issued guidance provided through the California Supreme Court’s decision in Huerta v. CSI Electrical Contractors regarding compensable “hours worked” under California laws, and the California Privacy Protection Agency’s Enforcement Advisory regarding businesses’ obligations under “data minimization” principles. While the guidance provides some clarity into the respective issues addressed, it also obligates employers to consider whether their policies and protocols are compliant. To gain some insight, take a few minutes to review highlights of the guidance summarized below.
California Supreme Court Provides Clarity on Compensable “Hours Worked”
On March 25, 2024, the California Supreme Court issued a decision in Huerta v. CSI Electrical Contractors Inc. (2024) 15 Cal.5th 908, providing clarity to the meaning of compensable “hours worked” under California’s Industrial Welfare Commission Wage Order No. 16 (“Wage Order No. 16”) and Labor Code Section 512(e). Here’s what you need to know:
Plaintiff George Huerta was employed as a construction worker by Defendant CSI Electrical Contractors, Inc. to build a solar power facility on privately-owned land. To protect local endangered species, maintain safe operations, and prevent theft, the facility implemented certain protocols, including mandatory pre- and post-shift security checks, and several employer-mandated rules by which employees must abide during their drive between the security gate and the employee parking lot.
Prior to starting the shift, employees were required to line up in their vehicles and wait their turn to undergo a security check which included a scan of each employee’s badge and a visual inspection of the employee’s vehicle. Following the security check, employees were required to travel several miles on an access road to reach the employee parking lot. The drive often took 10-15 minutes and sometimes longer when biologists were clearing endangered species off the access road. During the drive, employees were subject to several rules, including speed limits, restrictions on horn-honking or loud music, prohibitions on walking or biking, passing other vehicles, stopping in the road, using ear pods, and smoking, and compliance with the employer’s drug and alcohol and anti-discrimination/harassment policies. Any violation of these rules could result in suspension or termination.
At the end of the shift, employees were required to drive down the same access road and repeat the process of lining up at the security gate to undergo a post-shift security check which again included a scan of each employee’s badge and a visual inspection of the vehicle. During the pre- and post-shift security checks, security guards had the right to physically search the vehicles for stolen tools or endangered species. Both the entry and exit procedures took up to a minute per vehicle and caused delays of five to over 30 minutes.
Although the Defendant compensated employees for the time taken to be shuttled between the employee parking lot and the worksite, it did not compensate employees for the time spent waiting for and undergoing security checks or for time spent traveling between the security gate and the employee parking lot. In accordance with a collective bargaining agreement, Defendants also did not compensate employees for a 30-minute meal period during which employees were required to remain at the worksite.
Plaintiff filed a class action against Defendant seeking unpaid wages for time spent waiting for and undergoing security checks, traveling on the access road between the security gate and the employee parking lot, and during his 30-minute meal periods. The district court granted Defendant’s summary judgment motions, finding the employees were not entitled to wages because, at all relevant times, they were not subject to the requisite level of employer control necessary to render the time compensable, and the employees were not entitled to compensation for their meal periods pursuant to the collective bargaining agreement.
Plaintiff appealed to the Ninth Circuit, which certified the following three questions to the California Supreme Court:
- Whether time spent on the employer’s premises in a personal vehicle waiting to have a badge scan and visual vehicle inspection before exiting a security gate is compensable as “hours worked.”
- Whether time spent on the employer’s premises in a personal vehicle, driving between the security gate and the employee parking lot, while subject to employer-mandated rules, is compensable as “hours worked” or as “employer-mandated travel.”
- Whether time spent on the employer’s premises, when workers are prohibited from leaving but not required to engage in employer-mandated activities, is compensable as “hours worked” when that time was designated as an unpaid meal period under a qualifying collective bargaining agreement.
On March 25, the California Supreme Court issued its decision, answering the three questions as follows:
- Time spent waiting for and undergoing a mandatory security check on the employer’s premises in a personal vehicle is compensable as “hours worked” under Wage Order No. 16. In concluding so, the court found that the plaintiff was subject to employer control “while awaiting, and during” the security check (i.e., required to wait for and undergo the security check and remained confined on the premises until completion), the plaintiff was required to perform “specific and supervised tasks” as part of the security check (i.e., required to undergo a visual, and possibly physical, vehicle inspection), and the security check was performed for the employer’s benefit (i.e., to prevent theft of tools and on-site endangered species).
- Time spent traveling between the security gate and the employee parking lot is compensable as “employer-mandated travel” under Wage Order No. 16, if the employee’s presence was required at the security gate for an employment-related reason (i.e., presence required under employer’s rules or procedures) and not simply because passing through the location is the only means to enter or leave the worksite. The court noted that the travel time was not compensable as “hours worked” under Wage Order No. 16 because ordinary workplace rules (i.e., rules to ensure “safe, lawful, and orderly conduct”) imposed on an employee during their drive to the worksite in a personal vehicle does not create the requisite level of employer control.
- Where an employee is covered by a collective bargaining agreement in compliance with Wage Order No. 16 and Labor Code Section 512(e), an “unpaid meal period” is compensable as “hours worked” for which the employee must be paid minimum wage if the employee is prohibited from leaving the employer’s premises and, thus, is prevented from engaging in otherwise feasible personal activities (i.e., such restraint constitutes employer control).
Although the court’s decision is fact-specific, employers can benefit from the guidance provided as to what constitutes employer control and instances in which such control is sufficient to render an employee’s time as compensable “hours worked.”
California Privacy Protection Agency Focuses on “Data Minimization” Principles
On April 2, 2024, the California Privacy Protection Agency (“CPPA”) issued its first Enforcement Advisory (the “Advisory”), which focuses on businesses’ obligations to practice “data minimization” related to consumer requests under the California Consumer Privacy Act (“CCPA”). The Advisory emphasizes that “data minimization” is a foundational principle of the CCPA, which businesses should apply each time it collects, uses, retains, and shares consumers’ personal information, including information collected when processing consumers’ CCPA requests (e.g., requests to opt-out or limit disclosure of data).
The CPPA’s guidance on applying “data minimization” principles include the following:
- Collection, use, retention, and sharing of consumer information should be reasonably necessary and proportionate to achieve the purpose for which the information was collected or processed.
- Businesses should not require a consumer to provide additional information beyond what is necessary to send an opt-out preference, submit requests to opt-out of sale/sharing, or submit requests to limit disclosure or use of sensitive personal information.
- When verifying a consumer’s identity, match the identifying information provided by the consumer to the consumer’s personal information already maintained by the business. If additional information is requested, delete it as soon as practicable after processing the consumer’s request.
The Advisory provides several scenarios to illustrate how businesses can comply with the “data minimization” principles when (1) responding to a consumer’s CCPA request to opt-out of the sale/sharing of personal information, and (2) verifying a consumer’s identity to process a CCPA request to delete personal information. When applying “data minimization” principles to consumer requests, employers should consider the following questions:
- What is the minimum personal information that is necessary to achieve this purpose?
- Do we need to ask for more personal information than we already have?
- What are the possible negative impacts posed if we collect or use the personal information?
- Are there additional safeguards we could implement to address the possible negative impacts?
- To what degree of certainty (reasonable or reasonably high) do we need to verify the identity of the consumer? How sensitive is the information to be deleted and what is the risk of harm to the consumer posed by unauthorized deletion?
- Can we rely on the information we already have, or is it necessary to request additional information to comply with the request? Is asking for this information to verify a request to delete an email address disproportionate and excessive?
While the Advisory’s guidance is not binding and does not provide a safe harbor for businesses, it serves as an indication that “data minimization” is an enforcement priority for the CPPA.
Please contact an NFC team member if you have any questions or seek further assistance.
