With the advent of cost-effective GPS devices and smartphone tracking apps, employers may effectively monitor their workforce like never before. An employee’s distance traveled, sales routes, and productivity (among other things) can now be verified in real time, which is a seductive thought to most employers, to say the least. But there are things to consider before using tracking technologies to monitor employees, such as constitutional rights of privacy, state criminal statutes, union and labor issues, and good old-fashioned tort claims. In this article, we’ll review some legal considerations and provide some tips for navigating the evolving legal landscape of GPS tracking.

In California, the right to privacy is an express constitutional right. Article I, Section I of the California Constitution provides that “[a]ll people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.” The California Constitution differs from the U.S. Constitution in this regard, even though a right to privacy has been extrapolated from various provisions of the U.S. Constitution. The fact that the California Constitution makes the right to privacy explicit requires employers to give serious consideration to privacy issues in the workplace before taking actions that might expose them to liability.

The issue of GPS tracking of employees is less established, and employers have little formal guidance on what practices are permissible and what are not. A good starting point for analyzing potential GPS tracking practices is California Penal Code Section 637.7. That provision states: (a) No person or entity in this state shall use an electronic tracking device to determine the location or movement of a person. (b) This section shall not apply when the registered owner, lessor, or lessee of a vehicle has consented to the use of the electronic tracking device with respect to that vehicle. (c) This section shall not apply to the lawful use of an electronic tracking device by a law enforcement agency. (d) As used in this section, “electronic tracking device” means any device attached to a vehicle or other movable thing that reveals its location or movement by the transmission of electronic signals. (e) A violation of this section is a misdemeanor.

Section 637.7 thus makes it illegal to monitor the movements of any person, including a vehicle owned by that person, without their consent. Company-owned vehicles could presumably be monitored without the employee’s consent, as long as the owner of the vehicle (the company) consents. However, notifying employees of such tracking (and even obtaining their consent to such tracking) is the safest practice given the still-developing legal landscape with regard to this issue, and particularly in light of new privacy laws going into effect, such as the California Consumer Privacy Act, discussed further below. Additionally, with regard to monitoring employees via smartphone apps or device tracking, providing clear notice and obtaining consent is generally considered best practices. (Although, it is subject to debate whether smartphone apps qualify as a “device” attached to the “telephone” for purposes of being subject to section 637.7.)

In addition to the penal code, employers may be subject to civil tort claims for invasion of privacy based on their actions. A civil claim for intrusion into private affairs requires: (1) an intentional intrusion “into a place, conversation or matter as to which the plaintiff has a reasonable expectation of privacy”; (2) “in a manner highly offensive to a reasonable person.” In order for GPS tracking of employees to meet this standard, employees would need to have a reasonable expectation of privacy regarding their location that is intruded upon in a “highly offensive” manner. Arguably, employees should not have an expectation of privacy when using company-owned vehicles during business hours or for work purposes. However, whether GPS monitoring of such vehicles constitutes a violation of privacy would require considering various factors, including whether the employee uses that company-owned vehicle regularly, parks it at his or her house during non-work hours, or uses it for personal reasons during off-work hours, among other things.

It is likely that monitoring the location of an employee during non-work hours or during the performance of non-work tasks – to say nothing of monitoring an employee’s own private vehicle – could be viewed as “highly offensive” to a reasonable person and a violation of an employee’s expectation of their privacy. Ultimately, determining whether any given practice constitutes an actionable violation of privacy requires a court to weigh various factors, including the nature and context of the alleged intrusion, as well as the reasonableness of the motives, purposes, and objectives for the disputed practice.

Beyond statutory and tort liability, employers need to consider whether their employees belong to a union, or are subject to a collective bargaining agreement, some of which have specific provisions regarding privacy rights that might conflict with intended employer actions. Employers should review any provisions of such agreements that may apply to their workforce and ensure that GPS monitoring of employees is not specifically prohibited by the agreement and that the employer’s contemplated practices are consistent with the privacy rights set forth in the agreement.

Finally, with the newly passed California Consumer Privacy Act (“CCPA”) going into effect on January 1, 2020, employers must consider the disclosure obligations and potential liability that come with GPS tracking of employees going forward. The CCPA gives California residents significant new data privacy access, disclosure, and deletion rights and does not distinguish between residents in their roles as consumers or employees (you can read more about the CCPA and how it will affect your business here). Thus, employees have the same rights as any consumer to request that a company (in this case, their employer) disclose how their personal information is being collected and used, and well as to obtain access to and/or deletion of that information. Because GPS tracking information collected about employees falls under the broad definition of “personal information” used in the CCPA, employers will be obligated to affirmatively disclose such collection practices at or before the point of collection, provide employees with a copy of that data upon request, and delete that data unless it is necessary to be maintained for a business purpose.

In sum, before venturing into the wild west of GPS tracking, the safest course for employers implementing GPS tracking is to:

1. Confirm there are no union issues raised by the tracking.
2. Provide written notice and obtain clear prior written consent from employees that the employer is tracking vehicle movements (regardless of whether the vehicle is company-owned or privately owned).
3. Limit tracking to strictly work hours and only for specific business purposes. The GPS should be shut off during personal hours or personal vehicle use.
4. Develop and adopt a written policy regarding employee monitoring/tracking that sets forth the justifications and limits for GPS monitoring, how the information will be used and stored, and consequences for disabling the GPS.
5. Limit access to the tracking information to personnel who have a clear business need to know that information.
6. Store any tracking information securely, but in a manner that can be quickly accessed and provided in response to employee requests for personal information under the CCPA.

The information in this article does not constitute legal advice with regard to the use of any GPS tracking or other employee monitoring practices. Please contact Data Privacy partners Scott Hall at shall@coblentzlaw.com or 415.772.5798 or Brandi Brown at bbrown@coblentzlaw.com or 415.772.5797 with specific issues or questions.

Click here to download or print a PDF of this alert.

The U.S. Supreme Court issued two rulings last week on copyright law. In both cases, they acted to resolve conflicts between the Circuits, following closely to statutory language.

Fourth Estate Pub. Benefit Corp. v. Wall-Street.com, LLC.

In the first ruling, Fourth Estate Pub. Benefit Corp. v. Wall-Street.com, LLC., the Court clarified the Section 411(a) registration standard for filing infringement actions. “Registration” in advance of an infringement provides the opportunity to seek damages for past infringement as well as the infringer’s profits. In Fourth Estate, the Court resolved a dispute among circuits, where the Tenth and Eleventh Circuits held that complete registration of a work was required, and the Ninth Circuit (along with the Fifth Circuit) held that receipt by the Copyright Office of a complete application satisfied the registration requirement (See Cosmetic Ideas, Inc. v. IAC/Interactivecorp, 606 F.3d 612, 616-17, 621 (9th Cir.)).

In Fourth Estate, the Court held that the only satisfactory reading of the Section 411(a) language “…no civil action for infringement of the copyright in any United States work shall be instituted until preregistration or registration of the copyright claim has been made…” requires registration of the copyright.

The Copyright Office has a procedure for “expedited registration,” which can be requested on the grounds that litigation is imminent. The expedited procedure generally speeds the registration process up from several months to a few weeks. But it’s not cheap: There is a special handling fee of $800.

Rimini Street, Inc. v. Oracle USA, Inc.

In Rimini Street, Inc. v. Oracle USA, Inc., the Court held that the Copyright Act’s provision for a discretionary award of “full costs” means all costs enumerated in the law and does not allow courts to award costs beyond the categories provided in the general “costs” statute (28 U.S.C. Sections 1821 and 1920). This means that prevailing parties in copyright actions cannot recover non-taxable legal fees, such as expert witness costs. Writing for the Court, Justice Kavanaugh said: “Full costs’ are all the ‘costs’ otherwise available under law. The word ‘full’ operates in the phrase ‘full costs’ just as it operates in other common phrases: A ‘full moon’ means the moon, not Mars. A ‘full breakfast’ means breakfast, not lunch.”

The Takeaway

Owners of copyrighted content should think ahead and not wait to encounter infringement before applying to register works. When you create valuable content, you should have a regular registration program. Applying to register copyrights is fast and easy, and we’re always here to help.

For further information, contact Intellectual Property attorney Karen Frank (kfrank@coblentzlaw.com).

Fourth Estate Pub. Benefit Corp. v. Wall-Street.com, LLC, 586 U.S. ___ (2019)
Rimini Street, Inc. v. Oracle USA, Inc., 586 U.S. ___ (2019)

The California Consumer Privacy Act of 2018 (“CCPA”) was signed into law by Governor Jerry Brown on June 28, 2018, and goes into effect on January 1, 2020. The CCPA gives significant new data privacy rights to California residents with respect to their personal information that is collected and maintained by companies doing business in California. Even if you are compliant with current privacy laws, you must consider how the CCPA may affect your business. And, if you have not already started steps for compliance with the CCPA, now is the time.

Businesses cannot afford to wait until next year to think about or prepare for the wide-ranging impacts of this new law. Specifically, affected businesses need to: (1) decide now whether they will or will not sell personal information to third parties (and analyze any modifications to business services that may be required if they will not (or cannot) sell such information); (2) update websites and privacy policies with required information disclosures; (3) ensure that sufficient systems, processes, and resources are in place to respond to consumer requests for access to or deletion of their personal information and required disclosures; and (4) analyze and adjust any contracts with service providers that may be necessary to ensure compliance with the law.

Does The CCPA Affect Your Business?

Unless you conduct business operations wholly outside of California (including having no online presence in California), the CCPA probably applies to your business. The CCPA applies to all businesses – regardless of location – that conduct business (including online sales) in California and collect personal information from California residents if at least one of the following thresholds are satisfied:

• Gross annual revenues in excess of twenty-five million dollars ($25,000,000)
• Collection of personal information from 50,000 or more California residents, households, or devices annually
• Fifty percent (50%) or more of annual revenues are derived from selling consumers’ personal information

For some businesses, this is an easy determination. But even if you do not believe your company meets these thresholds at first glance, you may want to give this further consideration. For example, because “personal information” under the CCPA is defined broadly enough to encompass essentially every piece of information related to a California resident or household, information such as IP addresses that are collected merely from website visits constitutes collection of personal information under the CCPA. Therefore, even putting aside what personal information your business collects from customers, employees and other California residents in the course of its transactions and operations, if your business has a website accessible to California residents, you are likely to exceed the 50,000-resident annual threshold, and your company must likely comply with the CCPA.

What Are Your Obligations Under The CCPA?

The CCPA provides the following privacy rights to California consumers:

• Right to know what personal information is collected about them
• Right to know whether their personal information is sold or disclosed to third parties
• Right to opt-out of the sale of their personal information
• Right to access portable copies of their personal information
• Right to request deletion of their personal information
• Right to equal service and pricing even if they exercise their privacy rights under law

This will require, among other things, that businesses:

1. Disclose to consumers – at or before the point of collection – the categories of personal information collected and the business purposes for such collection. Businesses must also disclose on their websites and in their privacy policies the categories of personal information they sell or disclose for a business purpose, or must provide a statement that they do not sell or disclose such information.
2. Have sufficient data mapping and inventories of the personal information they collect about California residents (and their households and/or devices) and internal processes and resources in place to be able to respond (within 45 days) to requests for access to or deletion of personal information submitted by consumers.Access requests require that a business provide consumers with: (1) the categories of personal information collected; (2) the sources from which that information is collected; (3) the categories of personal information sold or disclosed and the categories of third parties to whom it was sold or disclosed; and (4) the specific pieces of personal information the business has collected about the requesting consumer. Businesses must also disclose and make available various methods to consumers for making such information requests (including by toll free phone number, website, etc.) and train their employees to handle such requests properly.
3. Determine whether the business is (either intentionally or unintentionally) “selling” personal information as defined by the CCPA and either make adjustments to stop selling that information or make required disclosures on their website pages and privacy policies stating that they are selling personal information and notifying and enabling consumers to “opt out” of such sales.In this respect, compliance with the CCPA may require a “Do Not Sell My Personal Information” link on the website homepage. Because the CCPA defines “selling” information as any disclosure for valuable consideration, businesses should also consider whether adjustments need to be made to their vendor/service provider relationships and contracts to ensure that personal information is not unintentionally being “sold” as defined by the law. Additionally, businesses must ensure that they are not collecting any personal information from individuals under the age of 16 without affirmative “opt in” consent of the consumer (if between ages 13-16) or a parent/guardian (if under age 13).
4. Consider adjustments to business models or services offered (i.e., paid vs. free services) based on the inability to sell certain consumers’ information and the inability to discriminate against consumers who exercise their privacy rights.
5. Consider changes to internal policies regarding employee rights and understand the impact that new privacy rights of employees under the CCPA will have on the business. The CCPA does not distinguish between California residents in their roles as consumers, employees, patients, etc. Thus, employees have all the rights granted to any other “consumer” under the law, including rights to request access to and deletion of their personal information, rights to opt-out of the sale of their personal information, and a private right of action if their personal information is breached, among others. While employers may have a valid business reason to justify denying deletion requests during the period of employment, employees may request access to their confidential personnel files or other HR records about them and, without further clarification or amendment to the law, such information would presumably need to be provided. At a minimum, employees will need to be notified at or before the point of collection of any of their personal information and any internal policies should be updated to include disclosures of employee rights under the new law.

What Are The Penalties For Non-Compliance?

Businesses that fail to comply with the CCPA are subject to civil penalties in actions brought by the California Attorney General in amounts of $2,500 for each unintentional violation, or $7,500 for each intentional violation.

The CCPA also gives a private right of action to any California resident whose personal information is subject to a data breach and allows such residents to recover between $100-$750 per resident and incident, or actual damages, whichever is greater. The availability of statutory damages resulting from a data breach should provide significant incentives for companies to increase and improve their data security practices and breach response plans and procedures. Additionally, current state legislation is under consideration that would expand this private right of action to the violation of any provision of the new law.

Questions?

The above summary of the CCPA is a very high-level discussion of the duties and obligations businesses have under the new law and does not constitute legal advice with regard to compliance with the CCPA. There are many additional details and rights, as well as defenses and exemptions, to take into account in assessing what steps your business may need to take to comply with the CCPA. Please contact Litigation and Data Privacy partner Scott Hall at shall@coblentzlaw.com or 415.772.5798 to discuss additional questions or details and to determine how we can help your business be prepared for the CCPA.

Click here to download or print a PDF of this alert.