Background
In November 2023, Jacqueline Nampeera and Donna Prevost filed a class action against their employer, CMG Mortgage, Inc., alleging the company failed to pay overtime, failed to provide meal and rest breaks, committed various Labor Code violations, and engaged in unfair business practices. The complaint also sought civil penalties under the Private Attorneys General Act (PAGA). In January 2024, CMG moved to compel arbitration based on an arbitration agreement it claimed both plaintiffs had electronically signed via DocuSign on April 2, 2021.
CMG’s evidence rested primarily on declarations from its chief human resources officer, Melissa Harbourne. Harbourne stated she had sent an email to “all employees” on April 1, 2021, notifying them of an updated arbitration agreement. She asserted that both plaintiffs signed the agreement via DocuSign, pointing to unique Envelope IDs generated by DocuSign upon completion. However, Harbourne did not explain how CMG verified that the DocuSign documents were accessed and signed by the intended recipients, nor did she describe any security procedures ensuring only the named employees could have accessed and signed the agreements.
In opposition, both Nampeera and Prevost declared under penalty of perjury that, to the best of their knowledge, they did not electronically sign the 2021 arbitration agreement and never authorized anyone to sign on their behalf. Critically, both plaintiffs stated that CMG’s IT department had created their work email accounts and set up the associated passwords, and that their supervisors and IT personnel could access their email accounts. The trial court denied CMG’s motion, finding that CMG had not presented sufficient evidence to authenticate the electronic signatures, and CMG appealed.
The Court’s Holding
The First District Court of Appeal affirmed the trial court’s denial of CMG’s motion to compel arbitration. The court applied a three-step burden-shifting framework for disputes involving electronic signatures. At step one, CMG met its initial burden by attaching a copy of the arbitration agreement to its motion. At step two, the court found that plaintiffs’ declarations—stating they did not recall signing the agreement and that other people had access to their email accounts—were sufficient to create a factual dispute about the authenticity of the electronic signatures, shifting the burden back to CMG.
At the critical third step, CMG was required to establish by a preponderance of the evidence that the electronic signatures were authentic. The court found CMG failed to carry this burden. Harbourne’s declarations did not explain how CMG employees securely accessed the DocuSign portal or what security measures ensured that only the intended employee could have logged on and signed the agreement. Instead, Harbourne offered only a summary conclusion that it was “reasonable to conclude” the plaintiffs signed based on DocuSign’s Envelope IDs. Drawing on the framework established in Ruiz v. Moss Bros. Auto Group and Espejo v. Southern California Permanente Medical Group, the court found a “critical gap” in CMG’s evidence: unlike the successful proponent in Espejo, who demonstrated that a unique login and password was provided orally and required immediate reset, CMG presented no evidence of comparable security procedures.
The court also rejected CMG’s fallback argument that earlier arbitration agreements from 2019 and 2020 independently supported compelling arbitration. CMG had not sought to compel arbitration on those agreements in its motion and raised them as an independent basis only at the hearing—too late to preserve the issue. The court held this constituted forfeiture.
Key Takeaways
- Employers seeking to enforce electronically signed arbitration agreements must present evidence of specific security procedures that ensured the electronic signature was the act of the employee. A generic assertion that DocuSign generated a unique Envelope ID, without evidence of secure access controls such as unique usernames and passwords, is insufficient.
- An employee’s declaration stating they do not recall electronically signing an agreement, combined with evidence that others had access to their email and login credentials, is sufficient to create a factual dispute about signature authenticity and shift the burden back to the employer.
- Arguments raised for the first time at the hearing on a motion to compel arbitration are forfeited. Employers must present all bases for compelling arbitration in their moving papers, not in reply briefs or at oral argument.
Why It Matters
This opinion is significant for employers who rely on electronic signature platforms like DocuSign to obtain agreement to arbitration clauses. The decision makes clear that the mere use of a reputable e-signature platform is not enough—employers must also maintain and be prepared to prove robust security procedures that tie a specific electronic signature to a specific individual. This includes demonstrating that each employee had a unique, private login and password that only they could have used to access and sign the document. Employers whose IT departments create and control employee email credentials face particular vulnerability, as this arrangement raises inherent questions about whether someone other than the employee could have accessed and signed the agreement.
For employees and their counsel in wage-and-hour class actions, the case provides a roadmap for challenging the authenticity of electronic arbitration agreements. The court’s endorsement of “best of my knowledge” denials as sufficient to shift the burden—especially when paired with evidence of shared access to email accounts—gives employees a viable path to defeat motions to compel arbitration even when they cannot categorically deny having signed.