Effective January 1, 2020, residents of nursing homes and assisted living facilities are permitted by law to conduct electronic monitoring of their living space. Is your facility in compliance? In addition to making your residents informed of their option to conduct electronic monitoring of their rooms or living units, compliance policies must be put in place, and consent and notification forms must be made available to residents, roommates, and the facility. Facilities are also required to post signage at each entrance, advising that electronic monitoring devices may be present.

If you have questions about whether your facility is in compliance, or how to obtain necessary consents when electronic monitoring is conducted by a resident, please feel free to contact us.

Effective January 1, 2020, the Minneapolis Wage Theft Prevention Ordinance (the “Ordinance”) sets forth a stringent set of requirements to prevent and punish wage theft. In addition to the state law requirements, the Ordinance applies to all employers with employees who work in the City of Minneapolis for at least 80 hours in one year. The Ordinance requires employers to provide additional information within notices, pay stubs, and notice posters to covered employees, including all new hires and current Minneapolis employees, no later than January 1, 2020.

While employers are already required to provide notice to new employees pursuant to the state law requirements, the Ordinance requires employers to also provide all new and current Minneapolis employees a notice with the following information:

1. The date employment began or will begin;
2. The employee’s rights under the Minneapolis Sick and Safe Ordinance, including the date the employee began or will begin to accrue Sick and Safe Time;
3. The employer’s policy regarding gratuities, as applicable, and that sharing of gratuities is voluntary; and
4. The overtime policy applicable to the employee’s position, including when the overtime shall be paid and the rate(s) of pay.

The notice must be provided to and signed by all covered Minneapolis employees by January 1, 2020. Employers must retain the signed notice and records of when they provided the initial notice to each Minneapolis employee. Thereafter, any changes to the notice must be provided to each employee in writing before they take effect, which the employee must also sign.

Additionally, employers of covered Minneapolis employees must include information regarding the employee’s accrued and unused Minneapolis Sick and Safe Leave Time on each pay stub.

Employers must post a notice at all Minneapolis job sites in a conspicuous area which explains employee rights pursuant to the Ordinance in English and in any language spoken by at least five percent of the employees. If an employee does not work at a physical job site, the employer may provide a paper or electronic copy to the employee. An example of the notice poster and notice can be found here.

Pursuant to the Ordinance, an employer must pay all wages owed to any employee by reason of employment, for work performed in the City of Minneapolis, on the regularly established payday. An employee or other person may report any suspected violation of the Ordinance to the Minneapolis Department of Civil Rights (the “Department”). If the employer is found to have violated the Ordinance, the Department Director shall order the employer to cease and desist from engaging in the illegal practice and may order any appropriate relief, including compensatory damages, liquidated damages, and civil fines up to $2,000 per violation and failure to cooperate with the investigation.

Lastly, unlawful retaliation will be presumed if an employer materially changes the terms or conditions of the employee’s employment (which would include termination, a reduction in the employee’s wages or benefits, or other changes in employment that affect the employee’s career advancement) within ninety (90) days of the employee’s exercise of his or her rights under the Ordinance. The employer may rebut this presumption by presenting clear and convincing evidence that the action was taken for a non-retaliatory purpose.

It is imperative that employers promptly prepare now to comply with the Ordinance by January 1, 2020. For questions or assistance regarding the new requirements, please feel free to contact us.

On September 24, 2019, the Department of Labor (“DOL”) issued a final rule on overtime exemption under the Fair Labor Standards Act (“FLSA”) that is likely to impact more than 1.3 million American workers and their employers. The rule, to take effect January 1, 2020, increases the salary that “white collar” employees must earn to be exempt from overtime and minimum wage requirements, raising the threshold from $455 per week ($23,660 per year) to $684 per week ($35,568 per year). The final rule also raises the exemption threshold for “highly compensated employees,” who are still subject to a more minimal duties test, from $100,000 to $107,432 annually.

Are you prepared for January 1?

For employers to establish that an employee is exempt from overtime requirements under the “white collar exemption,” three criteria must be satisfied:

1. The employee must be paid on a salary (not hourly) basis not subject to reduction based on quality or quantity of work;
2. The employee must be paid at least $684 per week or $35,568 annually (the new “Salary Level Test”); and
3. The employee’s primary job duty must involve the kind of work that qualifies as exempt, that is, they are employed in a bona fide executive, administrative, professional or computer position, as defined by the regulations.

The final rule issued by the DOL only modifies the Salary Level Test above; the other two criteria are unchanged.

In addition, under the new rule, up to 10% of an employee’s annual non-discretionary bonuses and/or incentive payments (including commissions) can be counted toward meeting the salary level as long as such bonuses and/or incentive payments are paid at least on an annual or more frequent basis. In addition, if an exempt employee does not earn enough in non-discretionary bonuses or incentive payments (including commissions) in a given year (a 52-week period) to retain the salary level required for exempt status, an employer may provide a “catch up” payment within one pay period at the end of the 52-week period. Any such catch-up payment will count only toward the prior year’s salary amount and not toward the salary amount in the year in which it is paid.

It is imperative that employers promptly assess the impact the DOL’s new rule will have on their business and on their employees. By taking proactive steps now, employers may minimize the impact of the new overtime rules before they go into effect on January 1, 2020. For questions or assistance regarding the new rules, please feel free to contact us.

On September 30, 2019, the Minnesota Department of Commerce (Department) published in the State Register its Request for Comments relating to an upcoming rulemaking relating to Pharmacy Benefit Manager (PBM) Licensure and Regulation. According to the Request for Comments, the Department is evaluating “rules needed to establish explicit requirements for licensure and renewal of PBMs doing business in the State of Minnesota with various plan sponsors.” The Department is also considering the need for rules relating to “data collection, transparency reporting, enforcement standards, and other items needed as they come up” to implement the Minnesota Pharmacy Benefit Manager Licensure and Regulation Act (PBM Act), which the Minnesota Legislature passed earlier this year.

As noted in the Department’s solicitation for comments and under the PBM Act, PBMs serve as an intermediary between health plans and plan sponsors, negotiating prices with pharmaceutical manufacturers, managing drug formulary lists, processing claims, and reviewing requests for clinical appropriateness. Under the new law, all PBMs contracting with plan sponsors in the State must have a valid license from the Department, effective January 1, 2020. This new license is in addition to the third-party administrator (TPA) license issued by the Department, which most PBMs likely already have.

The Department notes that its Request for Comments should be of interest not only to PBMs and TPAs, but also to employer plan sponsors, health insurance companies, pharmacists, and consumers of prescription drugs.

A Request for Comments is one of the first steps that an agency takes when it begins the formal rulemaking process under Minnesota law. The rulemaking must be completed by December 31, 2021. Individuals or businesses interested in participating in the rulemaking process are strongly encouraged to do so now, prior to the drafting of the proposed rules.

For assistance in preparing and submitting comments as part of the rulemaking process, or for any other questions regarding this Alert, please feel free to contact David Aafedt or any other member of our Regulatory & Government Relations team.

The Washington State Housing Finance Commission (WSHFC) has released a report on transfer disputes, titled “Nonprofit Transfer Disputes in the Low Income Housing Tax Credit Program: An Emerging Threat to Affordable Housing.” The report discusses the recent increase in the number of challenges that private firms have made on nonprofit partners’ project transfer rights in the affordable housing community, which the WSHFC asserts is detrimental to the public interest.

The report outlines the challenges this trend presents to the availability of low-income housing in Washington and other states, and provides guidelines that it suggests courts follow in resolving disputes. This will be a closely watched issue in the affordable housing community, as the case law surrounding the issues of the LIHTC statute and right of first refusal continues to develop.

To read the full report, visit http://www.wshfc.org/admin/publications.htm.

Our team has been involved in a number of the matters referenced in the report; if you have questions or would like to discuss the report further, please feel free to contact your affordable housing attorney.

On August 1, 2019, the Hands-Free Bill will become law in Minnesota, requiring that drivers may only use their cellphones by voice command or single-touch activation. Drivers may not hold their phones in their hand. If your company has employees that use company or personal vehicles on company time, you may need to revise existing policies to ensure your employees are compliant with the new law.

Permitted Cellphone Use

Under the new law, drivers will only be allowed to text, make calls, use navigational applications, and listen to music if those activities are activated by voice command or single-touch activation without holding the phone. When using a navigational application, drivers must set their destination before driving.

Hand-held use is permitted only in the event of an emergency, or when in an authorized emergency vehicle while performing official duties.

Prohibited Cellphone Use

Drivers are prohibited from using a phone to make video calls, live-stream, use social media applications, game, view photos or videos, use non-navigation applications, and view texts or scroll/type on a phone.

GPS Systems

GPS and other navigation systems that are built into a vehicle are exempt from the new law.

Federal Motor Carrier Act

Employers should also be aware of a similar hands-free rule that was recently passed by the Federal Motor Carrier Safety Administration. The rule requires a commercial motor vehicle (CMV) driver to only use a phone hands-free or by single-touch activation. Employers should note that using a hand-held phone while driving a CMV can result in driver disqualification. An employer that allows or requires a driver to use a hand-held phone may also be fined up to $11,000.

Next Steps for Employers

Employers should evaluate their compliance with the Hands-Free Bill as soon as practicable to ensure they are prepared by August 1. To comply, employers may decide to prohibit employee phone usage entirely while driving; or make clear that employees must adhere to the Hands-Free Bill. Employers may also wish to purchase Bluetooth technology, AUX adapters, or phone clips for company vehicles to help employee drivers use voice command or single-touch activation consistent with the new law. For questions or assistance regarding the requirements under this new law to help revise or draft cell phone policies, please feel free to contact us.

The Minnesota Legislature recently passed, and Governor Walz signed, the Jobs and Economic Development Omnibus Bill, which goes into effect as of July 1, 2019.  The bill amends existing state labor laws and creates new civil and criminal penalties for “wage theft”, as well as new recordkeeping and notice requirements for Minnesota employers.

Wage Theft

The new law makes it a crime to commit “wage theft.”  Wage theft is defined as any of the following actions by an employer, if the employer also has an “intent to defraud”:

• Fails to pay an employee all wages, salary, gratuities, earnings, or commissions at the employee’s rate or rates of pay required by applicable law, when earned;
• Directly or indirectly causes any employee to give a receipt for wages for a greater amount than that actually paid to the employee for services rendered;
• Directly or indirectly demands or receives from any employee any rebate or refund from the wages owed the employee under contract of employment with the employer; or
• Makes or attempts to make it appear in any manner that the wages paid to any employee were greater than the amount actually paid to the employee.

Wage theft, as defined above, includes criminal penalties of imprisonment of up to 20 years and up to a $100,000 fine for any wage theft in excess of $35,000.  This particular portion of the law regarding wage theft goes into effect as of August 1, 2019.

Timing of Wage Payments

The new law also amends Minnesota Statute §181.101 regarding when wages must be paid.  Salaries, earnings and gratuities are now explicitly included in the types of wages that must be paid at least once every 31 days, and commissions earned by employees must be paid at least once every 3 months.  Further, commissions are now included in the types of wages that may be demanded for payment by the Minnesota Department of Labor and Industry (the “Department”).  The Department may charge and collect any commission not paid within 10 days of the demand, along with a penalty equal to 1/15 of the commissions earned but unpaid for each day beyond the 10-day limit.  The law also removes the prior 15-day cap on penalties for late payment of wages, and grants additional authority to the Department to assess penalties for violations of the law.

New Employer Recordkeeping Requirements

The new law also adds additional requirements to the earning statements that must be provided to employees at the end of each pay period.  In addition to the information required under Minnesota Statute §181.032, employers must now also include:

1. The rate or rates of pay, and basis thereof, including whether the employee is paid by the hour, shift, day, week, salary, piece, commission, or other method;
2. Allowances, if any, claimed pursuant to permitted meals and lodging;
3. The physical address of the employer’s main office or principal place of business, and a mailing address if different; and
4. The employer’s telephone number.

Employers are also now required to keep additional employee records.  In addition to the current requirement of keeping the name, address, occupation, rate of pay, the amount paid each pay period to each employee, and the hours worked each day and workweek by the employee, employers now must keep the following records:

• For employees paid at a piece rate, the number of pieces completed at each piece rate;
• A list of the personnel policies provided to the employee, including the date the policies were given to the employee and a brief description of the policies;
• A copy of the notice required under Minn. Stat. §181.032, paragraph (d), including any written changes to the notice.

New Written Employee Notice Requirement

The law also creates an entirely new requirement that employers provide a written notice to each employee at the start of employment, which contains the following information:

1. The rate or rates of pay and the basis thereof, including whether the employee is paid by the hour, shift, day, week, salary, piece, commission, or other method, and the specific application of any additional rates:
2. Allowances, if any, claimed pursuant to permitted meals and lodging;
3. Paid vacation, sick time, or other paid time-off accruals and terms of use;
4. The employee’s employment status and whether the employee is exempt from minimum wage, overtime, and other provisions of Chapter 177 of Minnesota Statutes, and on what basis;
5. A list of deductions that may be made from the employee’s pay;
6. The number of days in the pay period, the regularly scheduled pay day, and the pay day on which the employee will receive the first payment of wages earned;
7. The legal name of the employer and the operating name of the employer if different from the legal name;
8. The physical address of the employers’ main office or principal place of business, and a mailing address if different; and
9. The telephone number of the employer.

Employers are required to keep a copy of this notice, along with an acknowledgement signed by the employee that he/she received the notice.  The notice must be provided to the employees in English, and must also indicate that employees may request, by indicating on the form, that the notice be provided in a particular language. The commissioner will assist employers with providing the notice in additional languages, if needed.

Employers must also provide the employee with any written changes to the information contained in the notice prior to the date on which any changes take effect.

Next Steps for Employers

The new law is effective as of July, 1, 2019.  Therefore, employers should plan to evaluate compliance with the law as soon as practicable.  First, employers should review their payroll documentation to ensure that the earnings statements provided to their employees comply with the new requirements of Minn. Stat. §181.032, including the basis for the wage rate, allowance for meals and lodging, and the employer’s address and phone number.

Also, employers will need to provide new hires with a notice that includes the required categories of information as set forth above. If employers have employees earning commissions, the commission plans should be evaluated for compliance with the law.  Finally, given the new criminal penalties for wage theft, employers should ensure that their wage and hour practices are in compliance with the new requirements of the law.  For questions or assistance regarding the requirements under this new law, please contact us.

One of the single largest public data breaches in history was recently discovered, and it includes more than 770 million unique email addresses and over 21 million unique passwords. The massive breach was first reported by cybersecurity researcher Troy Hunt, who received multiple tips about the data’s availability on a popular hacking forum. The breach, which some are calling the “mother of all breaches,” appears to be a combination of more than 2000 smaller data breaches and leaks over a broad time period. Given the vast scale of the data dump, chances are good that your personal and/or company’s data can be found in the 87 gigabytes of leaked information.

What Happened?

The leaked data was made available for download through the well-known MEGA cloud storage service before being removed a few days ago. Initial reports indicate that the data may have been first posted online as early as October 2018. For a sense of scale, the breach, dubbed “Collection #1,” is more than five times larger than the headline-grabbing 2017 Equifax data breach that affected 148 million Americans. The leaked data set appears to include data from a variety of sources, including some data stolen between two and three years ago, as well as older data dating as far back as 2008. The passwords leaked in the data dump were decrypted by the hackers, and can be easily misused by any unscrupulous downloader. Most concerning of all, however, is that Collection #1 may just be the tip of the iceberg.

In an interview with the anonymous party offering to sell Collection #1 for just $45, security journalist Brian Krebs reported that the seller was also offering to sell several more volumes of stolen data, including downloads entitled Collection #2 through Collection #5. The seller also provided evidence suggesting that the additional collections were much larger than the leaked Collection #1, and contained data from more recent data breaches. Time will tell whether this is the largest hacked data leak in history.

What is the Risk?

We already know that the leaked email addresses and passwords from Collection #1 (and other breaches) are in the hands of hackers looking to illegally profit off the data. The question you should ask yourself is what is the risk of harm? Or, if you are a business owner, what does the breach mean for your business? The answer largely depends on one major risk factor: password reuse.

If you, your business’ customers, or your employees reuse the same passwords across multiple online accounts, you are at a significantly higher risk of harm from breaches like Collection #1. Using a technique known as credential stuffing, hackers can automatically test thousands of known email & password combinations across thousands more websites and accounts. That means that if you used the same password for your streaming music service, work email, and Amazon account, all three accounts could be at risk due to a single breach. Similarly, if an employee accesses your company’s computer system using the same password he or she used in one of the 2000+ breached databases contained in Collection #1, your company systems would also be vulnerable. Collection #1 should be a wake-up call for everyone who reuses passwords, because no matter how strong your password or how good your other security measures, password reuse makes a hacker’s job easy. The breach is also a stark reminder that security breaches at unrelated organizations can still affect your company’s IT systems.

What Can You Do About It?

 Your first step should include determining whether you or your business’s data was compromised by the Collection #1 breach. You can easily cross check your email addresses and passwords against a database containing the Collection #1 data, in addition to thousands of other known public data breaches. Companies can also do a domain search to see if any users’ passwords within their organizations were hacked. If you were not affected (lucky you!), you should still take the opportunity to review and improve your password and security practices. If, on the other hand, your password credentials were compromised, your focus should be on recovering from the breach by securing your accounts, fixing existing vulnerabilities, and preventing future harm.

Individuals can recover from breaches like the Collection #1 leak by immediately changing all affected passwords, enabling two-factor authentication for any accounts that enable it, and paying close attention to financial accounts and credit monitoring. Individuals can also minimize future harm by choosing strong, unique passwords for all new accounts, and never, ever reusing old passwords. A password manager can do wonders here, and is one of the few security measures that actually makes life easier. Use one.

Businesses have a steeper hill to climb. To begin, affected businesses should already have a detailed cybersecurity incident response plan, and should immediately assemble their incident response team, and follow the documented plan. If no such response plan exists, business owners should seek third-party assistance in responding to the breach to ensure all practical and legal obligations are met. Next, it is prudent to begin securing company systems by disabling any affected users’ account access and forcing password resets. A secondary measure may also include strengthening internal password policies by prohibiting use of any passwords exposed in the breach. After securing operations, businesses should determine whether any unauthorized access to company systems actually occurred. Breach response teams should review access logs and other data sources to identify suspicious log-ins or data traffic, especially for compromised user accounts. Computer forensic services can assist in this process if needed. Depending on the conclusion of the analysis, companies should either set about repairing any damage caused from the breach, or breathe a sigh of relief that no actual breach occurred. No matter the conclusion, the incident should be fully documented, and reported to any required parties in accordance with relevant legal requirements.

After the dust has settled, businesses should take the opportunity to review and update existing incident response procedures, information security policies, and other internal security mechanisms to ensure preparedness for future cyber-threats. Whether or not you or your business was affected by Collection #1 or any as-yet unknown future breaches, individuals and businesses alike can minimize their risk through awareness, planning, and following preferred security practices. When it comes to cybersecurity, there is no question that an ounce of prevention is worth a pound of cure.

For more information on this or other data security & privacy issues, contact Winthrop & Weinstine.

On December 11, 2018, the United States Environmental Protection Agency and the Department of the Army, the two agencies primarily responsible for regulating waters under the Clean Water Act, issued a pre-publication version of its proposed rule revising the definition of “waters of the United States” (aka “WOTUS”) under the federal Clean Water Act.

If finalized, the new rule would change the nature and scope of permits and approvals required for many projects, such as developments or infrastructure projects, that involve potential filling of wetlands or other waters.

This proposal is the second step in the EPA’s efforts to modify the WOTUS definition. The first step was a proposed rule repealing the Obama-era 2015 rule defining WOTUS.

The 2015 Rule

The 2015 Rule proposed what the Obama administration characterized as an easier, bright-line method to establish whether a water was subject to Clean Water Act jurisdiction. A number of states, however, disagreed and took the position in litigation that the rule, which included a broad list of waters in the definition of WOTUS, exceeded the EPA and Army Corps of Engineers’ regulatory jurisdiction under the Clean Water Act. An injunction against the rule was issued by the federal District Court in North Dakota, and a nationwide stay was issued by the federal Sixth Circuit Court of Appeals. Due to a jurisdictional ruling by the Supreme Court, however, the status of that national stay was called into question.

Proposed Repeal of the 2015 Rule and Addition of an Effective Date for the 2015 Rule

In July, 2017, the EPA and the Army proposed to repeal the 2015 rule.

In January, 2018, in the wake of the Supreme Court’s ruling finding that the Courts of Appeals lacked jurisdiction to review the rule, and in order to address confusion caused by litigation rulings affecting some, but not all, states, the EPA and the Army finalized a new rule delaying the implementation of the 2015 rule until 2020.

Meanwhile, the proposed repeal rule has not yet been finalized.

Proposed Revised Definition

The proposed definition largely follows Justice Scalia’s WOTUS definition as set forth in the 2006 Rapanos v. United States decision. According to the EPA, WOTUS would be limited to the following six categories:

• Traditional navigable waters (mostly large rivers and lakes, tidal waters and the territorial seas and tidally-influenced waterbodies, including wetlands) that are used in interstate commerce;
• Tributaries to traditional navigable waters;
• Certain ditches that are traditional navigable waters (such as the Erie canal), are subject to the tides, or were constructed in a tributary or were built in adjacent wetlands;
• Certain lakes and ponds, including those that are traditional navigable waters, lakes and ponds that contribute flow to a traditional navigable water and those that are flooded by a WOTUS in a typical year;
• Impoundments of a WOTUS, and
• Adjacent wetlands, meaning those that physically touch other jurisdictional waters or have a surface water connection to a WOTUS in a typical year.

Certain types of waters would be explicitly excluded from the definition of WOTUS:

• Ephemeral features, meaning those that flow only when it rains;
• Groundwater;
• Most farm and roadside ditches;
• Prior converted cropland;
• Stormwater control features in upland;
• Wastewater recycling structures in upland, and
• Wastewater treatment systems.

Effect of the Proposed Definition

While the proposed revision would likely lead to a significant reduction of the number of waters and wetlands subject to federal regulation across the nation, the on-the-ground effect on overall wetlands regulation in Minnesota will be less significant due to Minnesota’s robust regulation of wetlands under Minnesota’s Wetlands Conservation Act. The effect of the revised definition on activities affecting wetlands is likely to have greater regulatory impact in states that engage in less direct regulation of activities impacting wetlands. Also, some states may, in response to a reduced level of federal oversight, enact additional regulations governing impacts to public waters.

That said, the revised definition will affect the nature and scope of permits needed for some projects. In some cases, the only federal permit required for a project is a wetlands permit under section 404 of the Clean Water Act. If the wetland in question is no longer subject to federal regulation, however, a host of federal requirements that might be triggered by the need to get that federal permit might go away, such as compliance with the federal National Environmental Policy Act, the federal Endangered Species Act, and obligations under Section 106 of the federal National Historic Preservation Act. The need for a water quality certification by the state environmental protection agency (in Minnesota, the Minnesota Pollution Control Agency) under section 401 of the Clean Water Act also goes away.

Overall, while repealing the 2015 Rule and adopting the proposed rule based on Justice Scalia’s reasoning in Rapanos will reduce obligations under federal regulations for many projects, there may be added administrative costs to monitor and maintain compliance with varying state regulations.

Status of the Proposed Rule Revising the WOTUS Definition

Upon publication of the proposed rule in the Federal Register, the rule will be subject to a 60-day comment period. The EPA had also planned to host a webinar and a public meeting on the rule in January. As a result of the current government shutdown, however, the publication of the rule in the Federal Register, as well as the planned webinar and public meeting, have been postponed. It is anticipated that this proposal will move forward once the government reopens.