Court filing
Declaration of Whitty Somvichian — In re Plaid Inc. Privacy Litigation (Dkt. 113-1, N.D. Cal. No. 4:20-cv-03056)
Filed December 11, 2020 in In re Plaid Inc. Privacy Litigation; one of 174 filings from this case.
Record facts
| Court | U.S. District Court for the Northern District of California |
|---|---|
| Filed | 2020-12-11 |
U.S. District Court for the Northern District of California · No. 4:20-cv-03056-DMR · Doc. 113-1 · 2020-12-11 · Docket on CourtListener
Full text
SOMVICHIAN DECL ISO RJN ISO REPLY ISO
MTD CONSOL. AMEN. COMPLAINT
4:20-CV-3056-DMR
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
COOLEY LLP
ATTORNEYS AT LAW
SAN FRANCISCO
COOLEY LLP
MICHAEL G. RHODES (116127)
(rhodesmg@cooley.com)
WHITTY SOMVICHIAN (194463)
(wsomvichian@cooley.com)
KYLE C. WONG (224021)
(kwong@cooley.com)
LAUREN J. POMEROY (291604)
(lpomeroy@cooley.com)
ELLIE BARCZAK (329180)
(ebarczak@cooley.com)
101 California Street, 5th Floor
San Francisco, CA 94111-5800
Telephone:
+1 415 693 2000
Facsimile:
+1 415 693 2222
Attorneys for Defendant
Plaid Inc.
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
OAKLAND DIVISION
IN RE PLAID INC. PRIVACY LITIGATION
_____________________________________
THIS DOCUMENT RELATES TO:
ALL ACTIONS
Case No. 4:20-cv-03056-DMR
DECLARATION OF WHITTY SOMVICHIAN
IN SUPPORT OF REQUEST FOR JUDICIAL
NOTICE IN SUPPORT OF PLAID INC.’S
REPLY INS SUPPORT OF MOTION TO
DISMISS PLAINTIFFS’ CONSOLIDATED
AMENDED COMPLAINT
Date:
TBA
Time:
1:00 p.m.
Dept:
Courtroom 4 – 3rd Floor
Judge:
Donna M. Ryu
Trial Date: None Set
Date Action Filed: May 4, 2020
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 1 of 10
1
SOMVICHIAN DECL ISO RJN ISO REPLY ISO
MTD CONSOL. AMEN. COMPLAINT
4:20-CV-3056-DMR
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
COOLEY LLP
ATTORNEYS AT LAW
SAN FRANCISCO
I, Whitty Somvichian, hereby declare as follows:
1.
I am an attorney licensed to practice law in the State of California and am a partner
at the law firm Cooley LLP, counsel for Defendant Plaid Inc. (“Plaid”) in the above-titled action.
I make this declaration based on my personal knowledge of the matters stated herein, if called as a
witness, I could and would testify competently about them.
2.
I submit this Declaration in support of Plaid’s Request for Judicial Notice in Support
of Plaid Inc.’s Reply in Support of Motion to Dismiss Plaintiffs’ Consolidated Amended Complaint
(“Plaid’s RJN”) filed concurrently herewith.
3.
Attached hereto as Exhibit A is a true and correct copy of the document available
at https://web.archive.org/web/20150326011404/https://www.plaid.com/legal/, which contains
Plaid’s Privacy Policy as of March 26, 2015 (as indicated by the Wayback Machine capture date),
with an effective date of November 11, 2013 (as shown on page 7 of the PDF).
4.
Attached hereto as Exhibit B is a true and correct copy of the document available
at https://web.archive.org/web/20141010160817/www.plaid.com/legal/ which contains Plaid’s
Privacy Policy as of October 10, 2014 (as indicated by the Wayback Machine capture date), with
an effective date November 11, 2013 (as shown on page 12 of the PDF).
5.
Attached hereto as Exhibit C is a true and correct copy of the document available
at https://web.archive.org/web/20160319102837/www.plaid.com/legal/ which contains Plaid’s
Privacy Policy as of March 19, 2016 (as indicated by the Wayback Machine capture date), with an
effective date of November 11, 2013 (as shown on page 7 of the PDF).
6.
Attached hereto as Exhibit D is a true and correct copy of the document available
at https://web.archive.org/web/20150919214748/www.plaid.com/legal/ which contains Plaid’s
Privacy Policy as of September 19, 2015 (as indicated by the Wayback Machine capture date), with
an effective date of November 11, 2013 (as shown on page 12 of the PDF).
7.
Attached hereto as Exhibit E is a true and correct copy of the document available
at https://web.archive.org/web/20190101181607/https://plaid.com/legal/ which contains Plaid’s
End User Privacy Policy as of as of January 1, 2019 (as indicated by the Wayback Machine capture
date), with an effective date of June 14, 2018 (as shown on page 1 of the PDF).
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 2 of 10
2
SOMVICHIAN DECL ISO RJN ISO REPLY ISO
MTD CONSOL. AMEN. COMPLAINT
4:20-CV-3056-DMR
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
COOLEY LLP
ATTORNEYS AT LAW
SAN FRANCISCO
8.
Attached hereto as Exhibit F is a true and correct copy of the document available at
https://web.archive.org/web/20190530174759/https://plaid.com/legal/#end-user-privacy-policy
which contains Plaid’s End User Privacy Policy as of as of May 30, 2019 (as indicated by the
Wayback Machine capture date), with an effective date of May 29, 2019 (as shown on page 4 of
the PDF).
9.
Attached hereto as Exhibit G is a true and correct copy of the document available
at https://web.archive.org/web/20200101210746/https://plaid.com/legal/ which contains Plaid’s
End User Privacy Policy as of January 1, 2020 (as indicated by the Wayback Machine capture
date), effective December 30, 2019 (as shown on page 2 of the PDF).
10.
Each exhibit was downloaded by visiting the publicly available website
https://archive.org/web/ (the “Wayback Machine”), searching www.plaid.com/legal, and
identifying the version that was captured on the closest date preceding the date when each Plaintiff
alleges to have connected their financial accounts to Venmo according to the Consolidated
Amended Complaint (“CAC”) (the Exhibits’ “Capture Date”). CAC ¶¶ 100, 111, 121, 130, 140,
150, 159, 168, 178, 188, 199. While Exhibits A, B, C and D were captured by the Wayback
Machine on different dates, they all reflect the same Privacy Policy with the same effective date of
November 11, 2013.
11.
For Plaintiffs Mullen, Yeomelakis and Sacks, the Wayback Machine did not capture
Plaid’s Privacy Policy prior to the date when they allegedly linked their financial accounts, but
Exhibit A, captured on March 26, 2015 shows an effective date of November 11, 2013, which
precedes the dates when they allegedly linked their financial accounts.
12.
For Plaintiff Umali and Evans, whose sign-up dates are only listed as a year, 2015
and 2016 respectively, the capture dates are the closest available from the Wayback Machine that
predate January 1, 2015 and January 1, 2016, respectively.
13.
For Plaintiff Anderson, whose sign-up date is only listed as 2019, the applicable
version is either Exhibit E (captured on January 1, 2019 with an effective date of June 14, 2018) or
Exhibit F (captured on May 30, 2019 with an effective date of May 29, 2019).
14.
Exhibit G, which applies to Plaintiff Sotelo, contains the Privacy Policy effective
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 3 of 10
3
SOMVICHIAN DECL ISO RJN ISO REPLY ISO
MTD CONSOL. AMEN. COMPLAINT
4:20-CV-3056-DMR
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
COOLEY LLP
ATTORNEYS AT LAW
SAN FRANCISCO
December 30, 2019, which is the same effective date as Exhibit A (EFC No. 79-1) attached to the
Dettmer Declaration (EFC No. 79) in support of Plaid’s Motion to Dismiss (EFC. No 78). Exhibit
F confirms that this December 30, 2019 version of the Privacy Policy, previously submitted with
Plaid’s original Request for Judicial Notice, was in effect before Plaintiff Sotelo allegedly linked
his financial account.
15.
For the Court’s convenience, below is a chart that identifies, for each Plaintiff, the
applicable Exhibit, with the Exhibit’s Capture Date as shown in the Wayback Machine and the
effective date of the Privacy Policy contained therein, as shown by the “Last Updated” dated in the
document.
Plaintiff
App Sign-Up Date
Relevant
Exhibit
Capture
Date
Privacy
Policy
Effective
Date
Mullen
Mar. 2014
Venmo (CAC ¶ 150)
Ex. A
March 26,
2015
November
11, 2013
Yeomelakis
Mar. 2014
Venmo (CAC ¶ 199)
Ex. A
March 26,
2015
November
11, 2013
Sacks
June 2014
Venmo (CAC ¶ 159)
Ex. A
March 26,
2015
November
11, 2013
Curtis
Apr. 2015
Venmo (CAC ¶ 121)
Ex. A
March 26,
2015
November
11, 2013
Mitchell
Aug. 2015
Venmo (CAC ¶ 140)
Ex. A
March 26,
2015
November
11, 2013
Umali
2015
Venmo (CAC ¶ 188)
Ex. B
October 10,
2014
November
11, 2013
Schoeneman
July 2016
Venmo (CAC ¶ 168)
Ex. C
March 19,
2016
November
11, 2013
Evans
2016
Venmo (CAC ¶ 130) Ex. D
September
19, 2015
November
11, 2013
Cottle
Jan. 2019
Venmo (CAC ¶ 111) Ex E.
January 1,
2019
June 14,
2018
Anderson
2019
Venmo (CAC ¶ 100)
Ex. E
January 1,
2019
June 14,
2018
Ex. F
May 30,
2019
May 29,
2019
Sotelo
Feb. 2020
Venmo (CAC ¶ 178)
Ex. G
January 1,
2020
December
30, 2019
16.
Attached hereto as Attachment 1 is the chart from pages 4-5 of Plaid’s Motion to
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 4 of 10
4
SOMVICHIAN DECL ISO RJN ISO REPLY ISO
MTD CONSOL. AMEN. COMPLAINT
4:20-CV-3056-DMR
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
COOLEY LLP
ATTORNEYS AT LAW
SAN FRANCISCO
Dismiss, with three columns added to show the analogous disclosures from each version of the
Privacy Policy attached as Exhibits A-G hereto.
I declare under penalty of perjury under the law of the United States that the foregoing is
true and correct. Executed this 11th day of December 2020 in Oakland, California.
/s/ Whitty Somvichian
Whitty Somvichian
Attorneys for Defendant
Plaid Inc.
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 5 of 10
Attachment 1
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 6 of 10
Information
Plaintiffs
Allege Plaid’s
End User
Privacy Policy
Fails To
Disclose CAC
¶ 74(h).
Current1 Plaid Privacy
Policy (ECF No. 79-A)
Effective
December 30, 2019 &
Exhibit G
Privacy Policy Effective
November 11, 2013
Exhibits A, B, C, and D
Privacy Policy
Effective
June 14, 2018
Exhibit E
Privacy Policy Effective
June 14, 2018
Exhibit F
“Plaid collects
consumer bank
login
information
directly[.]”
“[W]e collect identifiers
and login information
required by the provider
of your account, such as
your username and
password, or a security
token. In some cases,
we also collect your
phone number, email
address, security
questions and answers,
and one-time password
(OTP) to help verify
your identity before
connecting your
financial accounts.” (Ex.
G at 4-5).
“[As an end user] you are
agreeing to share financial
information with us
including but not limited to,
your account credentials,
transactional histories,
account numbers and
balances/limits as well as
general identify data
including names and
addresses of all account
holders. You are enabling
us to interact with and
through your financial
institutions on your behalf
and with your consent.”
(Ex. A at 9; Ex. B at 15-16;
Ex. C at 9 and Ex. D at 15).
“When you connect your
financial accounts with a
developer application,
you may provide,
through our integrated
services, login
information required by
your financial institution
to access your account,
such as your username
and password, answers
to challenge questions,
or a security token.” (Ex.
E at 3).
“[W]e collect login
information required by
the provider of your
account, such as your
username and password,
answers to challenge
questions, or a security
token. In some cases, we
also collect your phone
number to help verify
your identity before
connecting your financial
accounts.” (Ex. F at 5.)
“Plaid uses
bank login
information to
access
consumers’
accounts.”
“When providing this
information, you give
the developer and Plaid
the authority to act on
your behalf to access
and transmit your End
User Information from
the relevant bank or
other entity that
provides your financial
accounts.” (Ex. G at 5).
“You are enabling us to
interact with and through
your financial institutions
on your behalf and with
your consent.” (Ex. A at 9;
Ex. B at 16; Ex. C at 9 and
Ex. D at 15).
“When providing this
information, you give
the developer, and Plaid
as its service provider,
the authority to act on
your behalf to access and
transmit your
information from the
relevant financial
institution.” (Ex. E at 3).
“When providing this
information, you give the
developer and Plaid the
authority to act on your
behalf to access and
transmit your information
from the relevant
financial institution and
other financial service
provider.” (Ex. F at 5.)
“Plaid collects
all available
private financial
and other
identifying data
“The data collected
from your financial
accounts includes
information from all
your accounts (e.g.,
“[As an end user] you are
agreeing to share financial
information with us
including but not limited to,
your account credentials,
“The data may include
information from all
your sub-accounts (e.g.,
checking, savings, and
credit card) accessible
“The data collected from
your financial accounts
includes information from
all your sub-accounts
(e.g., checking, savings,
1 Current in this chart means current as of December 11, 2020, the date of this filing.
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 7 of 10
from every
available
account once it
accesses the
‘linked’
account[.]”
checking, savings, and
credit card) accessible
through a single set of
account credentials.”
(Ex. G at 6).
“The information we
receive from the
financial product and
service providers that
maintain your financial
accounts varies
depending on the
specific Plaid services
developers use to power
their applications, as
well as the information
made available by those
providers.” (Ex. G at 5).
transactional histories,
account numbers and
balances/limits as well as
general identify data
including names and
addresses of all account
holders. You are enabling
us to interact with and
through your financial
institutions on your behalf
and with your consent.”
(emphasis added) (Ex. A at
9; Ex. B at 15-16; Ex. C at
9 and Ex. D at 15).
through a single set of
account credentials, even
if only a single sub
account is designated by
you.” (Ex. E at 4).
“The information we
receive from the
financial institutions that
maintain your financial
accounts may vary
depending on the
specific Plaid services
our developers use to
power their applications,
as well as the
information made
available by your
financial institutions.”
(Ex. E at 3).
and credit card)
accessible through a
single set of account
credentials.” (Ex. F at 6.)
“The information we
receive from the financial
institutions and other
financial service
providers that maintain
your financial accounts
varies depending on the
specific Plaid services our
developers use to power
their applications, as well
as the information made
available by those
institutions and
providers” (Ex. F at 5.)
Plaid sells the
consumer
banking data it
collects to its
clients[.]”
“We do not sell or rent
personal information
that we collect.” (Ex. G
at 9).
“We share your End
User Information for a
number of business
purposes: With the
developer of the
application you are
using and as directed by
that developer (such as
with another third party
if directed by you).”
(Ex. G at 8).
“Plaid does not sell or rent
any personal information to
marketers or third parties
that have not been explicitly
authorized (e.g. in the case
of a client).” (Ex. A at 10;
Ex. B at 17; Ex. C at 10 and
Ex. D at 16).
“If you authorize an
application to access your
Plaid account, you
acknowledge that we may
share financial information
with the third party that
provides the authorized
application.” (Ex. A at 10;
Ex. B at 17; Ex. C at 10 and
Ex. D at 17).
“We do not sell or rent
end user information to
marketers or other third
parties.” (Ex. E at 5).
“But we do share end
user information with
third parties as described
in this Policy. For
example, we share your
information with the
developer of the
application you are using
and as directed by that
developer.” (Ex. E at 5).
“We do not sell or rent
end user information to
marketers or other third
parties.” (Ex. F at 7.)
“[W]e share your
information with the
developer of the
application you are using
and as directed by that
developer (such as with
another third party if so
directed by you).” (Ex. F
at 7.)
“Plaid
otherwise uses
and monetizes
the consumer
banking data it
collects[.]”
“We use your End User
Information for a
number of business and
commercial purposes,
including to operate,
improve, and protect the
services we provide, and
“Plaid uses your personal
information as follows: To
operate and maintain the
Service (such as, overall
operating and maintenance,
providing customer service,
fixing malfunctions, testing
our security systems etc.)”
“We use the information
we collect to operate,
improve, and protect the
services we provide, and
to develop new
services.” (Ex. E at 4).
“We use the information
we collect to operate,
improve, and protect the
services we provide, and
to develop new Services.”
(Ex. F at 20.)
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 8 of 10
to develop new
services.”
(Ex. G at 7).
(Ex. A at 10; Ex. B at 16;
Ex. C at 10 and Ex. D at
16).
.
“Plaid stores the
consumer
banking data it
collects[.]”
“As permitted under
applicable law, even
after you stop using an
application or terminate
your account with one
or more developer, we
may still retain your
information (for
example, if you still
have an account with
another developer).”
(Ex. G at 9-10).
“All content submitted by
you to the Service or
collected on your behalf
from a third-party (e.g.,
client) application or a
financial institution (e.g., a
bank) may be retained by us
indefinitely, even after you
terminate your account.”
(Ex. A at 8; Ex. B at 14; Ex.
C at 8 and Ex. D at 13).
“As permitted under
applicable law, even
after you stop using an
application or terminate
your account with our
developers we may still
retain your information
(for example, if you still
have an account with
another developer or if
there is residual
information within our
databases or systems).”
(Ex. E at 6).
“As permitted under
applicable law, even after
you stop using an
application or terminate
your account with one of
our developers, we may
still retain your
information (for example,
if you still have an
account with another
developer).” (Ex. F at 7.)
Venmo
purchases, uses,
and stores the
consumer
banking data
collected by
Plaid[.]”
“We share your End
User Information for a
number of business
purposes: With the
developer of the
application you are
using and as directed by
that developer (such as
with another third party
if directed by you).”
(Ex. G at 8).
“If you authorize an
application to access your
Plaid account, you
acknowledge that we may
share financial information
with the third party that
provides the authorized
application.” (Ex. A at 10;
Ex. B at 17; Ex. C at 10 and
Ex. D at 17).
“But we do share end
user information with
third parties as described
in this Policy. For
example, we share your
information with the
developer of the
application you are using
and as directed by that
developer.” (Ex. E at 5).
“[W]e share your
information with the
developer of the
application you are using
and as directed by that
developer (such as with
another third party if so
directed by you).” (Ex. F
at 7.)
“Plaid continues
to access
accounts and
collect, sell and
use consumer
banking data
after the initial
connection is
made,
regardless of
whether the
consumer
continues using
the Venmo
app[.]”
“As permitted under
applicable law, even
after you stop using an
application or terminate
your account with one
or more developer, we
may still retain your
information (for
example, if you still
have an account with
another developer).”
(Ex. G at 9-10).
“All content submitted by
you to the Service or
collected on your behalf
from a third-party (e.g.,
client) application or a
financial institution (e.g., a
bank) may be retained by us
indefinitely, even after you
terminate your account.”
(Ex. A at 8; Ex. B at 14; Ex.
C at 8 and Ex. D at 13).
“As permitted under
applicable law, even
after you stop using an
application or terminate
your account with our
developers we may still
retain your information
(for example, if you still
have an account with
another developer or
there is residual
information within our
data bases or systems).”
(Ex. E at 6).
“As permitted under
applicable law, even after
you stop using an
application or terminate
your account with one of
our developers, we may
still retain your
information (for example,
if you still have an
account with another
developer).” (Ex. F at 7.)
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 9 of 10
“Plaid does not
exercise
adequate
oversight over
how consumer
banking data is
stored or used
after it sells that
data to
Venmo[.]”
“Please note that this
Policy only covers the
information that Plaid
collects, uses, and
shares. It does not
explain what developers
do with any End User
Information we provide
to them (or any other
information they may
collect about you
separately from Plaid).
This Policy also does
not cover any websites,
products, or services
provided by others. We
encourage you to review
the privacy policies or
notices of developers or
those third parties for
information about their
practices.” (Ex. G at 4).
“This policy does not apply
to any website, product or
service of any third-party
company even if the
website or application links
to (or from) the Service.
Plaid does not operate those
websites, products, or
services - please always
review the privacy practices
of a company before
deciding whether to provide
any information to them.”
(Ex. A at 8; Ex. B at 13; Ex.
C at 8 and Ex. D at 12).
“Please note that this
Policy only covers the
information that Plaid
collects, uses, and
shares, and it does not
explain what our
developers do with any
end user information we
provide to them (or any
other information they
collect about you, their
end user). This Policy
also does not cover any
websites, products, or
services provided by
others. We encourage
you to review the
privacy policies or
notices of our developers
or those third parties for
information about their
practices.” (Ex. E at 2-
3).
Please note that this
Policy only covers the
information that Plaid
collects, uses, and shares,
and it does not explain
what our developers do
with any end user
information we provide to
them (or any other
information they collect
about you, their end user).
This Policy also does not
cover any websites,
products, or services
provided by others. We
encourage you to review
the privacy policies or
notices of our developers
or those third parties for
information about their
practices. (Ex. F at 5.)
Case 4:20-cv-03056-DMR Document 113-1 Filed 12/11/20 Page 10 of 10File and source
- File
- gov.uscourts.cand.359040.113.1.pdf
- Size
- 181,507 bytes
- SHA-256
- 686bcf48ca312327343a04670d3c1b9bef0c96dbb9633575c0789b6ee0a154f2
- Original
- PACER (login required)