By Scott Hall & Mari Clifford

Download a PDF version of this report here.

Although we are just a few months in, 2021 has already been another busy year for data privacy developments. From new regulations and legislation to court decisions impacting privacy rights, let’s take a look at a few of the key data privacy developments so far this year.

New CCPA Regulations

Just when you thought the CCPA regulations were finalized, on March 15, 2021, the California Attorney General (“AG”) approved additional regulations intended to enhance consumer protections for opt-outs. Most significantly, the regulations ban “dark patterns” that complicate the opt-out process and prohibit businesses from burdening consumers with confusing language or unnecessary steps.

The revisions implement the following changes:

• Offline Collection and Notices: Businesses that sell personal information collected offline are now required to inform consumers in an offline method of their right to opt-out. This includes providing instructions on how to submit an opt-out request.
• Ban on Dark Patterns or Complications to the Opt-Out Process: Opt-out requests must “be easy for consumers to execute and shall require minimal steps to allow the consumer to opt-out.” The new regulations prohibit businesses from using any method that is designed to, or has the effect of, preventing a consumer from opting out. Specifically, businesses cannot require consumers to scroll through a privacy policy or listen to reasons why they should not opt-out before confirming their request. Additionally, the opt-out process cannot require more steps than the process to opt-in to the sale of personal information after having previously opted out, or use confusing language.
• Opt-Out Icon: Businesses may use an opt-out icon in addition to, but not in lieu of, notice of a right to opt-out or a “Do Not Sell My Personal Information” link.
• Requests from Authorized Agents: A business may require an authorized agent who submits a request to “know” or “delete” to provide proof that the consumer gave the agent signed permission to submit a request.
• Children’s Information: The regulations added the word “or” to section 999.332. As a result, businesses that sell personal information (“PI”) of children under the age of 13 “and/or” between the ages of 13 and 15 are now required to define in their privacy policies how consumers can make an opt-in to sale requests.

CPRA Preparation and Compliance

In November 2020, Californians voted to enact Proposition 24, also known as the California Privacy Rights Act (“CPRA”). The CPRA expands on the California Consumer Privacy Act of 2018 (CCPA), establishes a new privacy regulatory agency called the California Privacy Protection Agency (CPPA), provides new rights for consumers, and imposes new obligations on businesses.

The CPRA’s enforcement is set to begin on July 1, 2023, but the act has a look-back period to January 1, 2022. This means that data collected from January 1, 2022, is subject to the act, so businesses shouldn’t wait to develop the requisite policies and procedures in response to new requirements. CPRA compliance should be a priority for every covered business. Here are a few key points that businesses need to be thinking about:

Modification to the Scope of the CCPA

The CPRA modifies the CCPA’s scope in that it applies to businesses that (1) have annual gross revenue over $25 million in the preceding calendar year; (2) buy, sell, or share personal information of 100,000+ consumers or households; or (3) derive at least 50% of their annual revenue from selling or sharing consumer PI. Notably, the CPRA’s threshold of 100,000 consumers or households doubles the previous threshold under the CCPA of 50,000 consumers, households, or devices, and therefore could significantly reduce the scope of the act and its impact on smaller businesses.

Cross-Context Behavioral Advertising

The CPRA introduces the concept of data “sharing,” which is defined as “sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.” (Emphasis added.) The CPRA explicitly requires businesses to provide notice to consumers about data sharing practices and extends consumer opt-out rights to the sharing of personal information by a business to a third party.

Data Minimization

The CPRA introduces data minimization principles similar to those in the GDPR by prohibiting businesses from collecting more personal information than “reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed . . .”[1]  The CPRA also requires that businesses not retain personal information for longer than is reasonably necessary for the purpose for which it was collected, as well as to identify retention periods of data in the privacy notice to consumers.[2] Thus, all businesses should focus on making changes to limit data collection and processing of personal information to only what is reasonably necessary for the business.

Creation of California Privacy Protection Agency (CPPA)

The CPRA establishes a new enforcement agency, the CPPA. As the first agency of its kind in the United States, the CPPA will have the authority to investigate potential breaches and violations, draft enforcement regulations, and issue fines. This transfers the current CCPA and CPRA responsibilities from the Office of the Attorney General to the CPPA. Importantly, the CPRA cancels the grace period of 30 days that businesses have after being notified of an alleged breach or violation and raises the maximum on fines for violations.

Expanded Consumer Rights

Expansion of the Private Right of Action

The CPRA has expanded the scope of the private right of action by adding a cause of action for the unauthorized access and exfiltration, theft, or disclosure of an email address in combination with a password or security question and answer that could permit access to content. The act also clarifies that the implementation and maintenance of reasonable security procedures and practices following the breach do not constitute a cure.

New Consumer Rights Under the CPRA

• Right to correct: California residents have the right to correct inaccurate personal information the business holds about them. This mirrors the right to correction under the GDPR.
• Right to know about and opt-out of automated decision making: California residents can request access to and knowledge about how automated decision technologies work and what their outcomes are, and have a right to opt-out of the use of their PI for automated decision making.
• Right to opt-out of data “sharing”: In addition to being able to opt-out of data “selling,” consumers will be able to opt-out of data “sharing” for cross-context behavioral advertising purposes.
• Right to limit use of sensitive personal information: The CPRA introduces a new category of personal information called “sensitive personal information.” This includes precise geolocation data, race, religion, sexual orientation, social security numbers, and certain health information outside the context of HIPAA. Consumers may limit the use and disclosure of sensitive personal information by businesses. Businesses may also need to add another link to their website homepage to allow consumers to exercise their rights to limit the use of their sensitive information.

Next Steps For Businesses

Update Website Links

Covered businesses will need to (1) update their “Do Not Sell My Personal Information” links to read “Do Not Sell or Share My Personal Information,” and (2) include a separate link titled “Limit the Use of My Sensitive Personal Information” where such information is collected. The CPRA encourages businesses to make “a single, clearly-labeled link” that allows a consumer to swiftly and simultaneously opt-out of sale or sharing of PI and limit the use or disclosure of the consumer’s sensitive PI. If a business complies with automated opt-out signals sent from browsers or other extensions then a business will not need to provide such links.

Update Contracts

Businesses will need to impose expanded duties on their service providers and contractors to protect information, comply with audit requests, and assist businesses in responding to consumer requests or other obligations. The CPRA requires all sales, sharing, and disclosures of personal information for a business purpose to be made pursuant to a contract. Even disclosures of deidentified information to any recipient will require a contract setting out clear restrictions on attempts at reidentification. To comply with these new CPRA provisions, businesses will need to (1) develop the necessary contracting materials in preparation for a contracting exercise; (2) assess all transfers of personal information to identify which provisions are required for which recipients; and (3) begin the process of updating and negotiating the required agreements.

Conduct Additional Data Mapping

Businesses will need to identify any information that is shared, not just sold. To meet the CPRA’s data minimization requirements, businesses will need to establish and comply with document retention periods. Additionally, businesses need to understand what algorithms or automated decision-making processes are being performed on personal information collected and maintained by the business.

Adjust Responses to Data Subject Access Requests

The CPRA now requires businesses to use commercially reasonable efforts to correct inaccurate personal information in response to a verifiable consumer request. As a result, businesses must be prepared to adjust their response procedures or be ready to explain why they cannot meet a consumer request because “doing so proves impossible or would involve a disproportionate effort.”

Businesses should also start preparing processes for how they will respond to California consumers who exercise their new privacy rights which include “do not share” requests, correction requests, and requests to limit the use of sensitive data. Finally, with more state privacy laws looming, many businesses will need to consider whether a “California versus everyone else” approach still makes sense for their business.

Assess High-Risk Activities

Per the CPRA, the California AG will at some point issue regulations requiring businesses whose processing poses “significant” risks to consumer privacy and security. These “high-risk” businesses will then need to perform annual security audits and submit regular risk assessments to the new CPPA. Companies that collect large volumes of sensitive data should start designing internal audit procedures in anticipation of this requirement. More details on this to come.

Update Do-Not-Track and Advertising Models

Businesses will need to anticipate and prepare their models for what advertising looks like with fewer cookies, tags, and pixels. They will also need to start reacting to Do-Not-Track signals and may need to adopt new opt-in marketing strategies. Given the volume of work this may entail, businesses should commence this earlier rather than later so as not to run into compliance issues when enforcement of the CPRA begins.

More State Legislation Regarding Data Privacy

The landscape of privacy law and compliance issues is changing rapidly as many states beyond California are enacting or contemplating new, more comprehensive privacy legislation similar to the CCPA/CPRA.

Virginia Privacy Law

Virginia became the second state to pass comprehensive data privacy legislation when it enacted the VCDPA on March 2, 2021. The VCDPA applies to entities that conduct business in Virginia or produce products or services that are targeted to Virginia residents and either (1) control or process the personal data of at least 100,000 consumers during a calendar year, or (2) control or process the personal data of at least 25,000 consumers and derive at least 50% of gross revenue from the sale of personal data. The VCDPA provides consumers rights of access, correction, deletion, data portability, appeal, and exclusion. Because the Act does not provide for any exceptions to these rights, businesses are expected to comply regardless of the hardship posed or the impractical nature of the request.

To best prepare for these eventualities, businesses will need to update their policies that address the new obligations imposed upon them under the VCDPA including data minimization, purpose limitations, security controls, express consent requirements, and data protection assessments. Given that the VCDPA goes into effect in two years, businesses are strongly advised to start evaluating their current data processing activities and begin developing a compliance program that meets the requirements of the VCDPA.

Other States Introducing Privacy Laws

As the internet and new technologies continue to raise questions about privacy and use of PI, state lawmakers are trying to keep up by addressing novel privacy issues through legislation.

California’s and Virginia’s legislatures are not the only ones paying attention to these shifting tides in the privacy law landscape. Several states, including Washington, Oklahoma, Connecticut, Florida, Illinois, and New Jersey currently have active bills awaiting committee hearings or votes. Other states such as Alabama, Arizona, Colorado, Kentucky, Maryland, Massachusetts, Minnesota, New York, Rhode Island, South Carolina, Texas, Utah, Vermont, and West Virginia recently introduced comprehensive privacy acts to state legislatures. Progress on these laws should be monitored closely over the next few months.

Status of a Federal Privacy Law

And, of course, no update would be complete without monitoring federal privacy legislation. Congresswoman Suzan DelBene (WA) introduced the Information Transparency and Personal Data Control Act on March 10, 2021, which would create a national data privacy standard for the protection of personal information, including information related to financial, health, genetic, biometric, geolocation, sexual orientation, citizenship and immigration status, social security numbers, and religious beliefs, as well as information about minors.

Given the potential patchwork of state laws mentioned above, many businesses would welcome a uniform standard, but the timing of when a comprehensive federal law will actually be enacted remains unclear.  For now, businesses must closely monitor the various state laws being passed and determine what laws they may need to comply with.

Recent Court Decisions Regarding Privacy

Data privacy litigation remains active, and recent court decisions have provided some clarity and guidance regarding the scope of certain privacy laws.

Scope of CCPA’s Private Right of Action

Certain recent court rulings have limited the scope of the CCPA’s private right of action.  For example, in Gardiner v. Walmart Inc. et al, No. 4:20-cv04618 (N.D. Cal.), defendants secured a ruling rendering a narrow interpretation of the CCPA. In Gardiner, a Walmart customer sued the retail company under the CCPA for failing to implement and maintain reasonable and appropriate security procedures and practices to protect information he gave to Walmart to create an account on the company’s website. Gardiner claimed that his personal information had been subject to unauthorized exfiltration on Walmart’s website and sold on the dark web, exposing him to purportedly ongoing risk of financial fraud and identity theft. On March 5, 2021, the District Court for the Northern District of California dismissed Gardiner’s claim for damages under the CCPA on two grounds. First, the court could not determine whether the alleged breach occurred before or after the effective date of the CCPA because the complaint did not specifically allege a date when the purported breach occurred. Second, the court held that in order to state a viable CCPA claim, a plaintiff must allege specific, unauthorized disclosure of “personal information.” This could indicate that courts will strictly interpret the CCPA to apply only where the specific categories of personal information listed in the law are actually exposed in a data breach. However, it is important to note that the court granted the Plaintiff leave to amend, allowing the Plaintiff to potentially cure the complaint’s shortcomings and perhaps get a second shot at litigating his claims.

In McCoy v. Alphabet, Inc. et al., No. 5:20-cv-05427 (N.D. Cal.), the court held that there is no general private right of action under CCPA. Plaintiff Robert McCoy had filed a class action complaint against defendants Alphabet Inc. and Google LLC for monitoring and collecting the sensitive personal data of Android Smartphone users when they interact with non-Google applications on their smartphones, without first obtaining users’ consent. In its February 2, 2021 order denying in part and granting in part the Defendants’ motion to dismiss, the court emphasized that the Plaintiff had not pled a data security incident and had conceded during arguments that the CCPA claims should be dismissed because no data breach occurred. The order states that the CCPA, “confers a private right of action for violations of section [Cal. Civ. Code § 1798.150](a), which is related to personal information security breaches. Further, it explicitly states that ‘[n]othing in this title shall be interpreted to serve as the basis for a private right of action under any other law.’ Cal. Civ. Code § 1798.150(c).” Whether this reasoning is adopted in other cases remains to be seen.

Standing in Data Privacy Cases

At the Circuit Court level, there is currently ongoing dialogue regarding whether data breach victims can establish a right to sue merely by showing that they are at increased risk of identity theft.

The Second Circuit Court of Appeals recently issued a decision in McMorris v. Carlos Lopez & Assocs., 2021 U.S. App. LEXIS 12328 (2d Cir. Apr. 27, 2021) clarifying that the risk of identity theft after a data breach may be grounds to sue. The latter notwithstanding, the court affirmed the dismissal of a proposed class action against a veteran’s health services company over an accidentally sent email that contained workers’ social security numbers. In the summer of 2018, Defendant’s employee accidentally sent an email to 65 others at the company. Attached to the email was a spreadsheet containing sensitive personally identifiable information of approximately 130 current and former employees. Three plaintiffs whose information had been disclosed filed suit. They asserted claims for negligence, negligence per se, consumer protection, and other state law claims on behalf of California, Florida, Texas, Maine, New Jersey, and New York classes. Upon the Defendant’s motion, the District Court dismissed the case for lack of subject matter jurisdiction. An appeal to the Second Circuit followed.

On appeal, the Second Circuit noted that it has been “suggested” that there is a circuit split on standing in the data breach context concerning whether a plaintiff may establish standing based on a risk of future identity theft or fraud stemming from the unauthorized disclosure of that plaintiff’s data. However, the court found that “requiring plaintiffs to allege that they have already suffered identity theft or fraud as the result of a data breach would seem to run afoul of the Supreme Court’s recognition that ‘[a]n allegation of future injury may suffice’ to establish Article III standing ‘if the threatened injury is certainly impending, or there is a substantial risk that the harm will occur.’” The Second Circuit then went on to hold that in the abstract, “plaintiffs may establish standing based on an increased risk of identity theft or fraud following the unauthorized disclosure of their data.”

The Second Circuit’s decision contrasts somewhat with the Eleventh Circuit’s recent opinion in Tsao v. Captiva MVP Restaurant Partners, LLC, 986 F.3d 1332, 1339 (11th Cir. 2021) holding that a plaintiff alleging a threat of future identity theft or other harm lacks Article III standing unless the hypothetical harm alleged is either certainly impending or there is a substantial risk of such harm taking place. (Emphasis added) The Tsao case arose out of a security breach at PDQ, a group of American restaurants owned by Captiva MVP Restaurant Partners. Within two weeks, PDQ posted a notice notifying its customers that its systems had been a victim of a cyber-attack. Tsao filed suit to recover damages stemming from the breach. The dispute in the class-action lawsuit was based on two questions. First, whether Tsao and the class of patrons of the restaurant had standing to sue because they were exposed to the future risk of identity theft, despite not suffering any misuse of their information. Second, whether Tsao’s efforts to mitigate the risk of future identity theft presented a concrete injury sufficient to establish standing. The Eleventh Circuit answered no to both issues.

Conclusion

In sum, we’re off to a fast and furious start to 2021, but more is coming. This ever-changing area of the law requires businesses to take proactive measures now to prepare themselves for the compliance obligations coming their way. Stay tuned for further developments. If your company needs assistance with any privacy issues, Coblentz Cybersecurity and Data Privacy attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.

Download a PDF version of this report here.

 

[1] CPRA, Section 1798.100(c).

[2] CPRA, Section 1798.100(a)(3).

By Fred Alvarez

On September 30, 2020, the California legislature passed SB 973, California’s pay equity data law. The law, codified under Government Code section 12999, requires certain employers with California employees to file an annual Employer Information Report that includes employee data on pay, hours, and demographics (“pay data”). Pay data is due to the DFEH (California Department of Fair Employment and Housing) on March 31, 2021.

Who Must Report?

All private employers with “100 or more U.S. employees and who [are] required to file an annual Employer Information Report (EEO-1) pursuant to federal law,” and at least one California employee must file an annual Employer Information Report.

An employer has the requisite number of employees if the employer either employed 100 or more employees in the Snapshot Period chosen by the employer or regularly employed 100 or more employees during the Reporting Year. The Snapshot Period is a single pay period between October 1 and December 31 of the Reporting Year, which is “the prior calendar year.” For this year, then, the Reporting Year is January to December 2020, while the Snapshot Period is any pay period between October 1 and December 31, 2020.

What Must Employers Report?

Employers must report data similar to what was required in the federal EEO-1, Component 2 form. The EEOC has since discontinued the use of the Component 2 form, but is studying the data it has collected from employers so far. In enacting SB 973, the California legislature has decided to pick up where the EEOC left off.

DFEH has now provided a data report template for both Excel and CSV files here.

As seen in the template reports, employers must provide the following data:

• For each establishment, during the Snapshot Period, the number of employees by race, ethnicity, and sex in ten different job categories.
• The number of employees—by race, ethnicity, and sex—whose annual earnings fall within each of twelve pay bands ranging from $19,239 and under to $208,000 and over.
• The total number of hours each employee worked during the entire Reporting Year, plus any paid time off hours.
• The Reporting Year and the Snapshot Period the employer selected.
• Additional employer information, including contact information, NAICS codes, total number of employees, and total number of establishments.
• Any clarifying remarks.
• A certification that the information contained in the pay data report is accurate and prepared in accordance with the law.

Employers must submit their pay data reports to DFEH’s pay data submission portal here. DFEH has also provided answers to common questions here.

How Will The Pay Data Be Used?

The California Legislature enacted this bill to encourage employers to self-assess potential pay disparities among their employees across race, gender, or ethnicity lines, and to promote compliance with equal pay and anti-discrimination laws.

It is important to note that the law now empowers DFEH to “receive, investigate, conciliate, mediate, and prosecute” complaints alleging unlawful practices in violation of the Equal Pay Act. The law also provides the Division of Labor Standards Enforcement access to this data, an authority already empowered to enforce labor laws.

These pay data reports are supposed to be a tool for self-compliance by employers and a tool for California agencies to enforce equal pay and anti-discrimination laws. As explored further below, however, challenges may arise when analyzing the pay data. For example, the reported job categories easily encompass employees with a variety of educational and professional backgrounds, roles, and responsibilities. In fact, the EEOC recently announced a contract with the National Academies of Sciences, Engineering, and Medicine’s Committee on National Statistics to independently assess the “quality and utility” of the equivalent federal pay data. The analysis is expected to conclude in 2021, but may shed significant light on employer concerns about the usefulness and validity of combining so many different jobs into the broad EEO-1 categories.

The California pay data is confidential under the law, and not subject to the California Public Records Act. It will not, however, be kept confidential for “administrative enforcement or through the normal rules of the discovery in a civil action.” DFEH is also empowered to publish aggregated data from multiple employers.

What Issues Should I Be Aware of When Gathering and Submitting Pay Data?

Identifying Employees

The definition of employee under Government Code section 12999(m)(1) is, “an individual on an employer’s payroll, including a part-time individual, whom the employer is required to include in an EEO-1 Report and for whom the employer is required to withhold federal social security taxes from that individual’s wages.” This definition raises a number of considerations when categorizing and counting employees.

Some issues to watch out for when identifying employees and tallying up your total number of employees include:

• Making sure that you count both full-time and part-time workers;
• Determining whether any temporary workers provided by a staffing agency or independent contractors still meet this definition of “employee;” and
• Identifying employees located both inside and outside of California, and correctly categorizing teleworking employees (for example, all employees assigned to California establishments must be reported whether or not they are teleworking).

Multiple Establishment Companies & Multiple Entities

Both single-establishment and multiple-establishment employers should submit single pay data reports. Multiple-establishment employers should report on all of their establishments.

Additionally, if your company is a parent company or a subsidiary, you should consider how to collectively submit pay data. Parent companies may submit a pay data report for themselves and their subsidiaries if the companies constitute a single legal entity. Alternatively, parent companies and their subsidiaries may each submit their own pay data reports.

Gathering and Submitting Pay Data

There are a number of challenges embedded in the pay data reporting framework.

Employee Demographic Data

First, employers must report on employees race, ethnicity, and sex. While employee self-identification is the preferred method of identifying an employee’s race, ethnicity, and/or sex, employers must still report the demographic data of employees who decline to provide this information. That means employers should use current employment records, other reliable records or information, or, as a last resort, observer perception. Employers should be particularly sensitive regarding the use of observer perception to categorize and report on an employee’s demographic data. In fact, the DFEH has indicated that observer perception should not be used to identify employees’ sex, but rather information such as the employees’ preferred pronouns.

Moreover, the available demographic categories are themselves limited. Employers should report employees’ sex by the three genders recognized in California: female, male, and non-binary. Employers should report race and ethnicity according to the following seven categories:

• Hispanic/Latino
• Non-Hispanic/Latino White
• Non-Hispanic/Latino Black or African American
• Non-Hispanic/Latino Native Hawaiian or Other Pacific Islander
• Non-Hispanic/Latino Asian
• Non-Hispanic/Latino American Indian or Alaskan Native
• Non-Hispanic/Latino Two or More Races

But not all employees will easily fit into one of these categories. For example, a male trans employee may self-identify as either male or non-binary. Similarly, an employee with both Hispanic/Latino heritage and Non-Hispanic/Latino heritage may not self-identify with any of the race/ethnicity categories above.

Employee Job Category Data

Second, employers must categorize employees as fitting into one of ten broad EEO-1 job categories used by the EEOC:

• Executive or senior level officials and managers;
• First or mid-level officials and managers;
• Professionals;
• Technicians;
• Sales workers;
• Administrative support workers;
• Craft workers;
• Operatives;
• Laborers and helpers; and
• Service workers.

Each of these categories is extremely broad both in terms of the types of job it encompasses, and the educational or experiential backgrounds of individual employees in that category. For example, the “Professionals” category includes both architects and dentists—and it includes architects and dentists with both thirty years’ experience and with five years’ experience. Further guidance on these categories is available on the EEOC.gov website.

Employee Salary Data

Employers must provide employee salary data into one of 12 pay bands increasing from $19,239 and under to $208,000 and over. These pay bands are thus particularly limited for highly-paid employees. For example, if all of a company’s employees in the job category “executive or senior level officials and managers” are paid $250,000 or more, the pay bands would not track differences in that high level of compensation among employees of different races, ethnicities, or sexes.

Putting It All Together

Given the analytical limitations of combining numerous, distinctive jobs into one of ten broad job categories, and then inserting them into 12 arbitrary pay bands, and the likelihood that the data will be (1) used in an enforcement action by a California state agency, or (2) uncovered via civil discovery methods, employers should consider providing “clarifying remarks” when submitting pay data. Clarifying remarks provide employers the opportunity to note the problems inherent in the pay data categories, and to preemptively note that any apparent pay disparities do not reflect comparisons of comparable jobs, employee roles, educational backgrounds, or seniority associated with jobs included and aggregated for reporting purposes only.

What Should I Do If I Have Additional Questions?

If you have specific questions or want to discuss how the Pay Equity Data Law may affect your business, please contact Fred Alvarez at falvarez@coblentzlaw.com or any attorneys from the Labor and Employment team here at Coblentz Patch Duffy & Bass LLP.

By Skye Langs

Last year brought the legal profession many things that we never expected, like trials conducted by Zoom and virtual happy hours, just to name a few. But it also brought a handful of new CEQA and land use decisions that, like many of the events of 2020, reminded legal practitioners to focus on the fundamentals. In litigation, that includes document preservation, evidence, and remedies. These details, though often overlooked in writ proceedings, can make or break your case.

Document Preservation

Civil litigants who know or reasonably anticipate that litigation is on the horizon have a duty to preserve relevant documents or risk sanctions (including, in extreme cases, terminating sanctions). In Golden Door Properties, LLC v. Superior Court of San Diego County (2020) 53 Cal.App.5th 733, we were reminded that this rule applies with equal force to a public agency conducting CEQA review.

In 2014, San Diego County began considering an approximately 600-acre residential and commercial development adjacent to the upscale Golden Door spa and resort. Almost immediately, Golden Door raised concerns about the project’s environmental impacts, and informed the County it would oppose the development. Nonetheless, the County took no special precautions to preserve documents or suspend its automatic deletion of emails.

Four years later, after the publication of the project’s Draft Environmental Impact Report, Golden Door served the County with a Public Records Act request, seeking documents related to the project. In response, the County produced 42 emails. When questioned about the limited production, the County explained that it had a policy of automatically deleting emails after 60 days.

The Fourth District Court of Appeal held that the County’s automatic deletion policy is unlawful because it destroys official records that the County is required to maintain. Specifically, CEQA provides that a broad range of documents “shall” be part of the record, including all correspondence and written materials relevant to the public agency’s compliance with CEQA or its decision on the project. (Pub. Res. Code § 21167.6.) By automatically deleting emails, the County made it impossible to create the required record.

Without an adequate record, the County may not be able to demonstrate its compliance with CEQA, adequately inform the public about the project, or demonstrate to the Court that its decisions are supported by substantial evidence. In other words, like any civil litigant, the County risked being penalized in future litigation due to poor document retention policies. But this risk can be avoided. Public agencies (as well as developers who partner with them) can take steps to ensure that all documents relevant to a project’s approval are maintained, and available in the event of future litigation.

Evidence

Just as civil litigators know that documents need to be preserved, we also know that at trial, we need to present the evidence that proves our case. This means putting on reliable witnesses who can provide testimony that satisfies the legal standards we are trying to meet. And in Tiburon/Belvedere Residents United to Support the Trails v. Martha Company (2020) 56 Cal.App.5th 461, we learned that it doesn’t matter how many witnesses you put on if they don’t check these boxes.

Petitioners Tiburon/Belvedere Residents United to Support the Trails (TRUST) sought quiet title to privately owned property north of San Francisco based on an alleged implied dedication that occurred prior to 1972, when a change in law essentially abolished implied dedications. To prove its case, TRUST needed to show that the property at issue was used by the general public, openly and continuously, for a period of more than five years preceding 1972, with full knowledge of the owner, without asking or receiving permission, and without objection.

TRUST put on 28 witnesses who testified that from 1967 to 1972, they used the property for recreation, without permission from the owner, and without any objections. Despite the overwhelming number of TRUST witnesses, there were two fatal flaws in the evidence presented.

First, and perhaps as an unavoidable consequence of the passage of time, almost half of its witnesses were minors in 1972. As the court noted, children are “‘born trespassers’ who cannot establish a reasonable belief by the public of its right to use the property.”

Second, all of TRUST’s witnesses lived in the area at the time. In other words, their testimony did not demonstrate widespread use by the general public, but rather showed limited local use that the property owner may have consented to as a neighborly accommodation, or failed to notice due the low visibility associated with local, as opposed to widespread, use.

In contrast, the property owner, who had diligently saved photographs showing fences, gates, and no trespassing signs on the property during the relevant time period, presented testimony demonstrating that it attempted to prevent public use. This, combined with the TRUST’s failure of proof, secured judgment in the property owner’s favor.

The lesson here? Even if – or perhaps especially if – your case relies on events that occurred well in the past, the quality of your evidence matters. As you prepare for trial, make sure you have the witnesses, and the testimony, to prove each element of your claim.

Remedies

While we must focus on proving our case, we also can’t overlook the most important part – what we get if we win, and how to minimize our losses if we don’t. But in CEQA cases, it is common for petitioners to simply request that the project approvals be vacated, with little analysis or argument about how to craft that relief. Last year, Sierra Club v. County of Fresno (2020) 57 Cal. App. 5th 979, reminded us that we should take as much care with remedies in writ proceedings as we do with damages, declaratory relief, or other civil remedies.

Sierra Club is the most recent installment of the Friant Ranch saga, which first began in 2007, when the County of Fresno issued its notice of preparation of a draft Environmental Impact Report (EIR) for a 942-acre master planned community. After the project was approved in 2011, litigation ensued, and the case has been working its way through the courts ever since. In 2018, the California Supreme Court concluded that the EIR’s discussion of the project’s air pollution impacts was inadequate, and remanded the case for further proceedings. (See Sierra Club v. County of Fresno (2018) 6 Cal.5th 502.) On remand, the trial court issued the requested writ of mandate, ordering the County to vacate the Friant Ranch project approvals and prepare a revised EIR.

The developer argued that this remedy was improper, and that instead of vacating the project approvals in their entirety, the court should have ordered a partial decertification of the EIR. The Court of Appeal for the Fifth District disagreed, holding that the relevant statutory language does not allow for partial certification. CEQA requires that lead agencies “certify the completion” of an EIR, and its compliance with CEQA, in its entirety. (See Pub. Res. Code § 21100; 14 Cal. Code Regs. § 15090.) There is no half measure.

One provision does, however, opens the door for partial decertification. Public Resources Code section 21168.9 contemplates that a court may issue a writ of mandate voiding a “determination, finding, or decision” of a public agency “in whole or in part.” While that language could support partial decertification of an EIR, the Court of Appeal concluded it was not proper in Sierra Club because the EIR’s air quality analysis was not severable from the other aspects of the project approvals.

Setting aside the statutory language, and the question of severability, it is apparent that the trial court decertified the EIR in its entirety because this was the remedy sought by the petitioners. At no point prior to the issuance of the writ of mandate did the County or the developer argue that this relief was improper, or present an argument for partial, rather than full, decertification. If they had addressed the remedies before it was too late, and presented a full-throated argument for partial decertification, it is possible that they could have minimized the impacts of this loss.

2021 and Beyond

This year will likely bring the legal profession even more surprises. But taking care of the basics such as document preservation, evidence, and remedies can often make the biggest difference in disputes, no matter how large or complex.