Court filing
Exhibit A — Plaid Privacy (Dkt. 122.1)
No. 4:20-cv-03056-DMR · Doc. 122-1 · Docket on CourtListener
Full text
Case 4:20-cv-03056-DMR Document 122-1 Filed 02/18/21 Page 1 of 17
EXHIBIT A
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 1 of2 of
Page 16 17
1
2
3
4 UNITED STATES DISTRICT COURT
5 NORTHERN DISTRICT OF CALIFORNIA
6
DEBORAH WESCH,
7 Case No. 20-cv-05991-SK
Plaintiff,
8
v. ORDER REGARDING MOTIONS TO
9 DISMISS
YODLEE, INC., et al.,
10 Regarding Docket Nos. 31, 32
Defendants.
11
12 This matter comes before the Court upon consideration of the motion to dismiss for failure
United States District Court
13 to state a claim filed by Yodlee, Inc. (“Yodlee”) and the motion to dismiss for lack of jurisdiction
14 filed by Envestnet, Inc. (“Envestnet”) (collectively, “Defendants”). Having carefully considered
15 the parties’ papers, relevant legal authority, and the record in the case, and having had the benefit
Northern District of California
16 of oral argument, the Court HEREBY GRANTS IN PART and DENIES IN PART Yodlee’s
17 motion and RESERVES RULING on Envestnet’s motion for the reasons set forth below.
18 BACKGROUND
19 Plaintiffs Deborah Wesch, Darius Clark, John H. Cottrell, William B. Cottrell, Ryan
20 Hamre, Greg Hertik, Daisy Hodson, David Lumb, Kyla Rollier and Jenny Szeto (collectively,
21 “Plaintiffs”) filed this purported class action against Yodlee and Envestnet to contest how
22 Defendants access and treat the personal financial data of Plaintiffs and purported class members.
23 Plaintiffs allege that Yodlee surreptitiously collects such data from software products that
24 it markets and sells to some of the large financial institutions, wealth management firms, and
25 digital payment platforms like PayPal, which use Yodlee’s software. (Dkt. No. 30 (First Amended
26 Compl. (“FAC”), ¶ 4.). Yodlee then acquires individuals’ financial data when those individuals
27 interact with the software installed on these financial institutions’ systems. (Id., ¶ 5.) The
28 financial institutions, such as PayPal, disclose to individuals that Yodlee is involved in connecting
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 2 of3 of
Page 16 17
1 their individual accounts to PayPal’s service for the limited purpose of confirming the individuals’
2 bank details, checking their balance, and transactions, as needed. However, Yodlee’s collection of
3 the individuals’ data goes well beyond their limited consent provided to facilitate a connection
4 between their bank accounts and PayPal. (Id., ¶ 7.) For example, when individuals link their bank
5 accounts to their PayPal account, they see the following message:
6 We use Yodlee to confirm your bank details and to check your
balance and transactions as needed, which can help your PayPal
7 payments to through. For more information, see our Privacy
Statement. You can turn off our use of Yodlee by removing
8 permissions for this bank in your Profile.
9 (Id., ¶ 55.) Then there is a button which states: “Agree and Link.” (Id.) Individuals do not give
10 PayPal or Yodlee permission to collect and store their financial information for resale. (Id., ¶ 56.)
11 However, Yodlee goes beyond facilitating the log in transactions. Yodlee stores a copy of
12 the individuals’ banking data and retains their usernames and passwords for their financial
United States District Court
13 institutions to collect and store the individuals’ bank account transaction history on an ongoing
14 basis. (Id., ¶¶ 8, 9, 57.) The individuals did not consent to this kind of data collection, which is
15 unrelated and unnecessary to complete their log in transactions. (Id.)
Northern District of California
16 Despite the statement that individuals may turn off the use of Yodlee, individuals cannot
17 opt out of or turn off Yodlee’s access to their bank account information after providing their
18 credentials. (Id., ¶ 58.) Additionally, even if the individuals sever their connection with their
19 financial institution, Yodlee continues to use the individuals’ log in information to access their
20 financial accounts. (Id., ¶¶ 10, 58.)
21 Yodlee then aggregates the individuals’ financial data and sells it to third parties. (Id., ¶
22 56.)
23 Plaintiffs allege that they suffered the following economic damages as a result of Yodlee’s
24 conduct:
25 (a) the loss of valuable indemnification rights; (b) the loss of other
rights and protections to which they were entitled as long as their
26 sensitive personal data remained in a secure banking environment; (c)
the loss of control over valuable property; and (d) the heightened risk
27 of identity theft and fraud.
28 (Id., ¶ 95.)
2
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 3 of4 of
Page 16 17
1 With respect to indemnity rights, Plaintiffs explain that, if someone uses an individual’s
2 credentials to log into a financial institution and improperly transfers funds, the individual would
3 not be indemnified for the improperly transferred funds because the individual initially provided
4 the credentials to Yodlee. (Id., ¶¶ 97, 114.)
5 Plaintiffs have an expectation of privacy in their personal financial data, which Yodlee is
6 collecting without their consent. (Id., ¶ 100.) Additionally, even though Yodlee sold the
7 individuals’ data in an aggregated manner, the individuals could be identified using three months
8 of transactions. (Id., ¶¶ 110-113.)
9 Plaintiffs bring the following claims against Defendants: (1) invasion of privacy under
10 both common law and the California Constitution; (2) violation of Stored Communication Act
11 (“SCA”), 18 U.S.C. § 2701; (3) unjust enrichment; (4) violation of California Civil Code § 1709;
12 (5) violation of California’s Unfair Competition Law (“UCL”), California Business & Professions
United States District Court
13 Code § 17200; (6) violation of California’s Comprehensive Data Access and Fraud Act
14 (“CDAFA”), California Penal Code § 502, (7) violation of California’s Anti-Phishing Act of 2005,
15 California Business & Professions Code § 22948.2, and (8) violation of the Computer Fraud and
Northern District of California
16 Abuse Act (“CFAA”), 18 U.S.C. § 1030.1
17 ANALYSIS
18 A. Applicable Legal Standard on Motion to Dismiss for Failure to State a Claim.
19 A motion to dismiss is proper under Federal Rule of Civil Procedure 12(b)(6) where the
20 pleadings fail to state a claim upon which relief can be granted. On a motion to dismiss under
21 Rule 12(b)(6), the Court construes the allegations in the complaint in the light most favorable to
22 the non-moving party and takes as true all material allegations in the complaint. Sanders v.
23 Kennedy, 794 F.2d 478, 481 (9th Cir. 1986). Even under the liberal pleading standard of Rule
24 8(a)(2), “a plaintiff’s obligation to provide the ‘grounds’ of his ‘entitle[ment] to relief’ requires
25 more than labels and conclusions, and a formulaic recitation of the elements of a cause of action
26 will not do.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citing Papasan v. Allain,
27
1
28 Plaintiffs also brought a claim for declaratory relief, but agreed to withdraw this claim in
response to Defendants’ motion to dismiss. (Dkt. No. 37 at p. 25 n. 20.)
3
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 4 of5 of
Page 16 17
1 478 U.S. 265, 286 (1986)). Rather, a plaintiff must instead allege “enough facts to state a claim to
2 relief that is plausible on its face.” Id. at 570.
3 “The plausibility standard is not akin to a probability requirement, but it asks for more than
4 a sheer possibility that a defendant has acted unlawfully. . . . When a complaint pleads facts that
5 are merely consistent with a defendant’s liability, it stops short of the line between possibility and
6 plausibility of entitlement to relief.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting
7 Twombly, 550 U.S. at 557) (internal quotation marks omitted). If the allegations are insufficient to
8 state a claim, a court should grant leave to amend, unless amendment would be futile. See, e.g.
9 Reddy v. Litton Indus., Inc., 912 F.2d 291, 296 (9th Cir. 1990); Cook, Perkiss & Lieche, Inc. v. N.
10 Cal. Collection Serv., Inc., 911 F.2d 242, 246-47 (9th Cir. 1990).
11 As a general rule, “a district court may not consider material beyond the pleadings in ruling
12 on a Rule 12(b)(6) motion.” Branch v. Tunnell, 14 F.3d 449, 453 (9th Cir. 1994), overruled on
United States District Court
13 other grounds, Galbraith v. Cnty. of Santa Clara, 307 F.3d 1119 (9th Cir. 2002) (citation omitted).
14 However, documents subject to judicial notice, such as matters of public record, may be
15 considered on a motion to dismiss. See Harris v. Cnty of Orange, 682 F.3d 1126, 1132 (9th Cir.
Northern District of California
16 2011). In doing so, the Court does not convert a motion to dismiss to one for summary judgment.
17 See Mack v. S. Bay Beer Distrib., 798 F.2d 1279, 1282 (9th Cir. 1986), overruled on other
18 grounds by Astoria Fed. Sav. & Loan Ass’n v. Solimino, 501 U.S. 104 (1991). “The court need
19 not . . . accept as true allegations that contradict matters properly subject to judicial notice . . . .”
20 Sprewell v. Golden State Warriors, 266 F. 3d 979, 988 (9th Cir. 2001).
21 B. Yodlee’s Motion to Dismiss.
22 Yodlee moves to dismiss all of Plaintiffs’ claims. The Court will address each claim in
23 turn.
24 1. Invasion of Privacy under the California Constitution and Common Law –
Claims 1 and 10.
25
To state a claim for invasion of privacy based on the common law tort of intrusion, a
26
plaintiff must allege: (1) that the defendant intentionally intruded into a place, conversation, or
27
matter as to which the plaintiff has a reasonable expectation of privacy; and (2) the intrusion must
28
4
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 5 of6 of
Page 16 17
1 be highly offensive to a reasonable person. Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 286
2 (2009). As the California Supreme Court explained, “the defendant must have ‘penetrated some
3 zone of physical or sensory privacy . . . or obtained unwanted access to data’ by electronic or other
4 covert means, in violation of the law or social norms.” Hernandez v. Hillsides, Inc., 47 Cal. 4th
5 272, 286 (2009) (quotingShulman v. Group W Productions, Inc., 18 Cal. 4th 200, 232 (1998)).
6 The right to privacy protected by the California Constitution is similar to the common law
7 claim. Hernandez, 47 Cal. 4th at 287. To state a constitutional claim for invasion of privacy, a
8 plaintiff must allege: (1) a legally protected privacy interest, such as conducting personal activities
9 without observation, intrusion, or interference as determined by established social norms; (2)
10 expectations of privacy which are reasonable; and (3) the intrusion must be so serious in nature,
11 scope, and impact as to constitute an egregious breach of social norms. Id.
12 Yodlee argues that Plaintiffs do not have a reasonable expectation of privacy in
United States District Court
13 anonymized, aggregated data. However, Plaintiffs allege that Yodlee improperly accessed and
14 retained their personal, financial accounts at an individual level. Plaintiffs have a reasonable
15 expectation of privacy in this data. Additionally, even though Yodlee sells this data in an
Northern District of California
16 aggregated manner, Plaintiffs allege that it would only take a few steps to identify the individual
17 Plaintiffs from the transactions. (Dkt. No. 30, ¶¶ 110-113.) Therefore, the Court finds that
18 Plaintiffs have sufficiently pled their invasion of privacy claims and DENIES Yodlee’s motion to
19 dismiss claims 1 and 10.
20 2. Stored Communications Act – Claim 2.
21 The Stored Communications Act prohibits any “person or entity providing an electronic
22 communication service to the public” from “knowingly divulg[ing] to any person or entity the
23 contents of a communication while in electronic storage by that service.” 18 U.S.C. § 2702(a).
24 “[T]he Stored Communications Act protects individuals’ privacy and proprietary interests. The
25 Act reflects Congress’s judgment that users have a legitimate interest in the confidentiality of
26 communications in electronic storage at a communications facility.” Theofel v. Farey-Jones, 359
27 F.3d 1066, 1072 (9th Cir. 2004). Yodlee argues that it (1) is not an electronic communication
28 service; (2) does not access the contents of a communication; or (3) does not keep Plaintiffs’ data
5
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 6 of7 of
Page 16 17
1 in electronic storage.
2 An electronic communication service (“ECS”) is “any service which provides to its users
3 the ability to send or receive wire or electronic communications.” 18 U.S.C. § 2510(15). “[T]he
4 statutory definitions of [electronic communication service] and [remote computing service] are
5 functional and context sensitive.” Hately v. Watts, 917 F.3d 770, 790 (4th Cir. 2019) (citation
6 omitted). “[W]ebsites and services that permit users to communicate directly with one another are
7 considered ECS providers.” Casillas v. Cypress Ins. Co., 770 F. App’x 329, 330 (9th Cir. 2019)
8 (holding that a system enabling document uploads and downloads did not qualify as an ECS
9 provider because it did not allow direct communication). Here, Plaintiffs allege that Yodlee
10 provides “a service that allows Plaintiffs and Class members the ability to send and receive
11 electronic communications from their financial institutions and third-party applications.” (Dkt.
12 No. 30, ¶ 162.) Therefore, Plaintiffs sufficiently allege that Yodlee is an ECS.
United States District Court
13 Next Yodlee argues that it does not access the “contents” of a “communication” under the
14 statute because it merely accesses transactional data. Yodlee cites to cases which distinguish
15 between the content or intended message and the information regarding the characteristics of the
Northern District of California
16 message generated in the course of the communication, such as header information or the webpage
17 address. In re Zynga Privacy Litig., 750 F.3d 1098, 1106-07 (9th Cir. 2014); see also Chevron
18 Corp. v. Donziger, 2013 WL 4536808, at *6 (N.D. Cal. Aug. 22, 2013) (distinguishing
19 information about the email users, such as their name, email address, and IP address, from the
20 content of the emails). However, here, the transactional data is the communication, as opposed to
21 information about the person or entity sending the communication. Additionally, the transactional
22 data includes sensitive financial records which reveal personal details of Plaintiffs’ lives and their
23 expenditures. Therefore, the Court finds that Plaintiffs sufficiently allege that Yodlee accesses the
24 contents of a communication under the statute.
25 However, with respect to “electronic storage” under the SCA, the Court finds that
26 Plaintiffs fail to allege facts sufficient to satisfy the statutory definition. The SCA defines
27 “electronic storage” as “any temporary, intermediate storage of a wire or electronic
28 communication incidental to the electronic transmission thereof” or “any storage of such
6
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 7 of8 of
Page 16 17
1 communication by an electronic communication service for purposes of backup protection of such
2 communication” 18 U.S.C.A. § 2510(17). Courts have held that communications stored for long
3 periods, such as one year, do not qualify as “temporary, intermediate storage” under the first
4 prong. In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1059 (N.D. Cal. 2012) (plaintiffs
5 failed to allege “temporary, intermediate storage” where they alleged the data was stored for up to
6 a one-year period); In re Toys R Us, Inc., Privacy Litig., 2001 WL 34517252, at *3 (N.D. Cal. Oct.
7 9, 2001) (SCA “only protects electronic communications stored ‘for a limited time’ in the ‘middle’
8 of a transmission, i.e. when an electronic communication service temporarily stores a
9 communication while waiting to deliver it.”). As for the second prong, the storage must be “for
10 purposes of backup protection.” KLA-Tencor Corp. v. Murphy, 717 F. Supp. 2d 895, 904 (N.D. Cal.
11 2010) (citing Theofel v. Farey-Jones, 359 F.3d 1066, 1075-76 (9th Cir.2004)).
12 Here, although Plaintiffs allege that Yodlee stores their financial data, they do not allege
United States District Court
13 that the storage is incidental to the electronic transmission of that data or that Yodlee’s storage is
14 temporary. Additionally, Plaintiffs do not allege that Yodlee stores its data for the purposes of
15 providing backup protection for the communication between Plaintiffs and their financial
Northern District of California
16 institutions. Instead, Plaintiffs allege that Yodlee stores the information for its own misuse of the
17 data. Therefore, the Court GRANTS Yodlee’s motion to dismiss as to Plaintiffs’ SCA claim, but
18 with leave to amend.
19 3. Unjust Enrichment – Claim 3.
20 Yodlee argues that Plaintiffs fail to plead their unjust enrichment claim with sufficient
21 particularity because it is grounded in fraud. Where a plaintiff alleges a claim grounded in fraud,
22 Federal Rule of Civil Procedure 9(b) requires the plaintiff to state with particularity the
23 circumstances constituting fraud, including the “who, what, when, where, and how” of the charged
24 misconduct. See Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1106 (9th Cir. 2003); In re
25 GlenFed, Inc. Sec. Litig., 42 F.3d 1541, 1547-49 (9th Cir. 1994). However, Rule 9(b) particularity
26 requirements must be read in harmony with Federal Rule of Civil Procedure 8’s requirement of a
27 “short and plain” statement of the claim. Thus, the particularity requirement is satisfied if the
28 complaint “identifies the circumstances constituting fraud so that a defendant can prepare an
7
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 8 of9 of
Page 16 17
1 adequate answer from the allegations.” Moore v. Kayport Package Exp., Inc., 885 F.2d 531, 540
2 (9th Cir. 1989).
3 However, a plaintiff pleading fraud by omission obviously cannot specify the time, place,
4 and specific content of an omission. Therefore, fraud by omission claims do not require the same
5 level of specificity required by a normal fraud claim. See, e.g., Washington v. Baenziger, 673 F.
6 Supp. 1478, 1482 (N.D.Cal. 1987) (“Where the fraud consists of omissions on the part of the
7 defendants, the plaintiff may find alternative ways to plead the particular circumstances of the
8 fraud. [F]or example, a plaintiff cannot plead either the specific time of the omission or the place,
9 as he is not alleging an act, but a failure to act.”) (internal citations and quotations omitted); see
10 also MacDonald v. Ford Motor Co., 37 F. Supp. 3d 1087, 1096 (N.D. Cal. 2014) (“Because the
11 plaintiffs are alleging a failure to act instead of an affirmative act, the Plaintiffs cannot point out
12 the specific moment when the Defendant failed to act.”) (quotation marks and brackets omitted).
United States District Court
13 Plaintiffs allege that Yodlee was unjustly enriched by surreptitiously acquiring their
14 sensitive financial data through a fraudulent scheme and then selling subscriptions to that data for
15 millions of dollars a year. (Id., ¶¶ 46, 47, 48.) When individuals are prompted to enter their
Northern District of California
16 credentials to connect their bank accounts to PayPal, the log in screens mirrored what they would
17 see if they were logging in directly to their respective banks. (Id., ¶ 6.) Yodlee then stores a copy
18 of those individuals’ bank log in information and exploits that information to routinely extract
19 financial data without individuals’ knowledge or consent. (Id., ¶¶ 8, 9.) Plaintiffs’ allegations are
20 sufficient to put Yodlee on notice of the substance of the alleged fraudulent scheme.
21 Yodlee also argues that Plaintiffs’ claim must be dismissed because they fail to allege that
22 they have an adequate remedy at law. However, Plaintiffs do make such an allegation. (Dkt. No.
23 30, ¶ 198.) Moreover, although Plaintiffs assert claims for legal remedies, Plaintiffs may plead in
24 the alternative. Accordingly, the Court DENIES Yodlee’s motion as to Plaintiffs’ claim for unjust
25 enrichment.
26 4. Cal. Civ. Code § 1709 – Claim 4.
27 California Civil Code section 1709 provides: “One who willfully deceives another with
28 intent to induce him to alter his position to his injury or risk, is liable for any damage which he
8
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page
Page9 of
1016
of 17
1 thereby suffers.” Cal. Civ. Code § 1709. Yodlee argues that Plaintiffs fails to allege the purported
2 deceit with sufficient particularity. However, as discussed above, the Court finds that Plaintiffs
3 sufficiently allege Yodlee’s alleged fraudulent scheme to deceive Plaintiffs. Yodlee also argues
4 that Plaintiffs fail to allege that they relied on any purported omission or that they suffered any
5 damages. Upon review of the Amended Complaint, the Court finds that Plaintiffs have alleged
6 sufficient facts to support their claim under Section 1709. Plaintiffs allege that, had they “known
7 the true nature, significance and extent of Defendants’ data practices, they would not have used
8 Yodlee.” (Dkt. No. 30, ¶ 94.) With respect to damages, as discussed above, Plaintiffs allege a
9 loss of privacy to their financial data. Accordingly, the Court DENIES Yodlee’s motion to
10 dismiss as to Plaintiffs’ claim under Section 1709.
11 5. Cal. UCL – Bus. & Prof. Code § 17200 – Claim 5.
12 To have standing to bring a claim under the UCL, Plaintiffs must have suffered an injury in
United States District Court
13 fact and must have lost money or property as a result of the unfair competition. See Cal. Bus. &
14 Prof. Code § 17204; see also Californians for Disability Rights v. Mervyn’s, LLC, 39 Cal. 4th 223,
15 227 (2006). “To satisfy the narrower standing requirements imposed by Proposition 64, a party
Northern District of California
16 must now (1) establish a loss or deprivation of money or property sufficient to qualify as injury in
17 fact, i.e., economic injury, and (2) show that the economic injury was the result of, i.e., caused by,
18 the unfair business practice or false advertising that is the gravamen of the claim.” Kwikset Corp.
19 v. Superior Court, 51 Cal. 4th 310, 322 (2011) (emphasis in original).
20 Yodlee argues that Plaintiff have not alleged that they lost money or property as a result of
21 Yodlee’s alleged conduct. The Court agrees. First, Plaintiffs argue that they allege damages of
22 “Loss of Benefit of the Bargain” by surrendering more or acquiring less in a transaction than they
23 otherwise would have. (Dkt. No. 37 (citing In re Anthem, Inc. Data Breach Litig., 162 F. Supp. 3d
24 953, 985 (N.D. Cal. 2016).) However, Plaintiffs have not alleged a transaction or contract with
25 Yodlee, therefore, it is not clear how they alleged such damages. Second, Plaintiffs argue in
26 reliance on Romero v. Securus Techs., Inc., 216 F. Supp. 3d 1078, 1091 (S.D. Cal. 2016) that they
27 alleged damages by alleging that they would not have used Yodlee if they knew the truth of its
28 practices. The court in Romero held that the plaintiffs sufficiently alleged damages by alleging
9
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 10 11
Page of of
16 17
1 that they would not have paid for and used the defendant’s telephone system, or would not have
2 paid as much for them, had they known about the defendant’s fraud. Id. However, because
3 Plaintiffs have not paid Yodlee any money and have not alleged that they paid PayPal any money
4 for use of its service; Plaintiffs have not alleged how they lost money or property in this manner.
5 Third, Plaintiffs argue that they have lost valuable indemnification rights. Plaintiffs allege
6 that, if a malicious person uses Plaintiffs’ credentials to improperly transfer funds, banks would
7 consider the transfer authorized because of Plaintiffs’ initial provision of their credentials to
8 Yodlee. Plaintiffs therefore would not be indemnified for the loss of transferred funds. (Dkt. No.
9 30, ¶ 97.) However, Plaintiffs have not alleged that anyone actually improperly transferred funds
10 from their accounts. Therefore, any monetary loss at this point is merely potential or hypothetical.
11 Fourth, Plaintiffs argue that Yodlee’s conduct placed them at heightened risk of identity theft and
12 fraud. However, again, Plaintiffs do not allege that any of them actually suffered identity theft or
United States District Court
13 any actual monetary loss. Therefore, the Court finds that Plaintiffs have not alleged facts
14 sufficient to establish standing required to bring a claim under the UCL. The Court thus grants
15 Yodlee’s motion as to this claim but will provide leave to amend.
Northern District of California
16 6. Computer Fraud and Abuse Act and California Comprehensive Data Access
and Fraud Act – Claims 7 and 9.
17
i. Loss or Damage.
18
Under both the Computer Fraud and Abuse Act (“CFAA), 18 U.S.C. § 1030 and the
19
California Comprehensive Data Access and Fraud Act (“CDAFA”), Cal. Pen. Code § 502,
20
Plaintiff must allege some damage or loss. In re Google Android Consumer Priv. Litig., 2013 WL
21
1283236, at *6 (N.D. Cal. Mar. 26, 2013) (both “CFAA and CDAFA [c]laims require some
22
showing of damage or loss, beyond the mere invasion of statutory rights”).
23
The CFAA criminalizes accessing a computer without authorization or exceeding
24
authorization. 18 U.S.C. § 1030(a). The statute also authorizes civil claims by individuals who
25
suffered damage or loss of at least $5,000 as a result. 18 U.S.C. § 1030(c)(4)(A)(i); 18 U.S.C. §
26
1030(g). The statute defines loss as “any reasonable cost to any victim, including the cost of
27
responding to an offense, conducting a damage assessment, and restoring the data, program,
28
10
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 11 12
Page of of
16 17
1 system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or
2 other consequential damages incurred because of interruption of service[.]” 18 U.S.C. §
3 1030(e)(11). Plaintiffs allege in a conclusory fashion that they incurred “the cost of conducting
4 damage assessments, restoring the data to its condition prior to the offense, and consequential
5 damages they incurred by, inter alia, spending time conducting research to ensure that their
6 identity had not been compromised and accounts reflect the proper balances” in excess of $5,000
7 per year. (Dkt. No. 30, ¶ 233.) The Court finds these conclusory allegations are insufficient and
8 thus GRANTS Yodlee’s motion to dismiss the CFAA claim with leave to amend.
9 Similarly, while the CDAFA does not set a minimum threshold, a plaintiff must allege that
10 she is the “owner or lessee of the computer, computer system, computer network, computer
11 program, or data” and must have suffered “damage or loss” to bring a civil claim. Cal. Penal Code
12 § 502(e)(1). Although Plaintiffs allege that they owned the data, they fail to allege that the data
United States District Court
13 incurred any damage or loss. Therefore, the Court GRANTS Yodlee’s motion to dismiss the
14 CDAFA with leave to amend.
15 Even though the Court is dismissing these claims on the grounds noted above, the Court
Northern District of California
16 provides guidance below on the other arguments because Plaintiffs may amend the CFAA and
17 CDAFA claims.
18 ii. Unauthorized Access.
19 Both the CFAA and the CDAFA prohibit unauthorized access to a computer system.
20 Yodlee argues that Plaintiffs provided consent and therefore its access was not unauthorized.
21 Under the CFAA, the statute defines “exceeds authorized access” to mean accessing “a computer
22 with authorization and to use such access to obtain or alter information in the computer that the
23 accesser is not entitled so to obtain or alter.” United States v. Nosal, 642 F.3d 781, 785 (9th Cir.
24 2011) (emphasis in original) (quoting § 1030(e)(6)); Musacchio v. United States, 136 S. Ct. 709,
25 713 (2016) (“exceeds authorized access” means “obtaining access with authorization but then
26 using that access improperly”). Here, Plaintiffs allege that Yodlee exceeded its authorization to
27 access their data. They allege that Yodlee stores their login information to their financial
28 institutions and accesses their account transaction history on an ongoing basis, unrelated to
11
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 12 13
Page of of
16 17
1 facilitating their transactions with PayPal. (Dkt. No. 30. ¶¶ 10, 56-58.) Such allegations are
2 sufficient to allege access which exceeds Yodlee’s authorization.
3 iii. Damage to a Computer.
4 Certain provisions of the CFAA and CDAFA require “damage” to the data or computer
5 system and not merely loss. Section 1030(a)(5)(A) of the CFAA requires a showing that a
6 defendant intentionally caused “damage” without authorization to a protected computer. 18
7 U.S.C. § 1030(a)(5)(A); see also see 18 U.S.C. § 1030(e)(8) (defining “damage” as “any
8 impairment to the integrity or availability of data, a program, system, or information”). Similarly,
9 section 502(c)(4) of the CDAFA requires a showing that a defendant “adds, alters, damages,
10 deletes, or destroys any data.” Cal. Pen. Code § 502(c)(4).2 The Court finds that Plaintiffs fail to
11 allege that any data or computer system was actually damaged. Plaintiffs cite to Therapeutic
12 Research Faculty v. NBTY, Inc., 488 F. Supp. 2d 991, 996 (E.D. Cal. 2007) for the proposition that
United States District Court
13 the “alleged unauthorized access to the Publication and the disclosure of its information may
14 constitute an impairment to the integrity of data or information even though ‘no data was
15 physically changed or erased.’” However, the only case Therapeutic Research cites to is a case
Northern District of California
16 which addresses the disclosure of trade secrets which, by their nature, are damaged by their
17 disclosure. See Shurgard Storage Ctrs., Inc. v. Safeguard Self Storage, Inc., 119 F.Supp.2d 1121,
18 1126 (W.D.Wash.2000) (stating “the alleged access and disclosure of trade secrets” constituted an
19 “impairment to the integrity of data . . . or information.”). Therefore, the Court finds that
20 Therapeutic Research is not persuasive. If Plaintiffs elect to amend their claims under Section
21 1030(a)(5)(A) of the CFAA and Section 502(c)(4) of the CDAFA, Plaintiffs shall allege that their
22 data was damaged.
23 iv. Intent to Defraud.
24 Sections 1030(a)(4) and 1030(a)(6) required a showing of “knowingly and with intent to
25 defraud.” See 18 U.S.C. §§ 1030(a)(4), (6). Yodlee argues that Plaintiffs fail to allege fraud with
26
27 2
Yodlee also points to Section 502(c)(1) of the CDAFA as requiring damage, but that
28 provision states “damages, deletes, destroys, or otherwise uses any data.” Cal. Pen. Code §
502(c)(1) (emphasis added).
12
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 13 14
Page of of
16 17
1 sufficient particularity. However, as discussed above, the Court finds that Plaintiffs have
2 sufficiently alleged a fraudulent scheme.
3 v. Traffics any Password as required under 18 U.S.C. § 1030(a)(6)
4 Section 1030(a)(6) of the CFAA prohibits a defendant from “traffic[ing] . . . in any
5 password or similar information through which a computer may be accessed without
6 authorization. . . .” See 18 U.S.C. § 1030(a)(6). The term “traffic” means “transfer, or otherwise
7 dispose of, to another, or obtain control of with intent to transfer or dispose of.” 18 U.S.C. §
8 1029(e)(5). Plaintiffs allege that Yodlee used Plaintiffs passwords and sold Plaintiff’s financial
9 data, but do not allege that Yodlee trafficked (transferred, or otherwise disposed of, to another)
10 Plaintiffs’ passwords. Therefore, Plaintiffs’ claim under Section 1030(a)(6) is deficient for this
11 additional reason. However, the Court will provide Plaintiffs with leave to amend.
12 7. California Anti-Phishing Act of 2005 – Claim 8.
United States District Court
13 The California Anti-Phishing Act of 2005, California Business and Professions Code §
14 22948.2, prohibits use of the internet to “solicit, request, or take any action to induce another
15 person to provide identifying information by representing itself to be a business without the
Northern District of California
16 authority or approval of the business.” Cal. Bus. & Prof. Code § 22948.2. “Identifying
17 information” includes a “[b]ank account number,” “[a]ccount password,” and “[a]ny other piece of
18 information that can be used to access an individual’s financial accounts . . . .” Id. § 22948.1(b).
19 Plaintiffs allege:
20 Defendants violated the Anti-Phishing Act by representing
themselves to be Plaintiffs’ and Class members’ financial institutions.
21 Defendants fraudulently and deceitfully impersonated those
institutions in order to induce Plaintiffs and Class members to provide
22 their login credentials to Defendants, as described herein. Defendants
did so without obtaining the authority or approval of each financial
23 institution.
24 (Dkt. No. 30, ¶ 216.) These allegations are sufficient to state a claim under the California Anti-
25 Phishing Act. Therefore, the Court DENIES Yodlee’s motion to dismiss this claim.
26 C. Legal Standards on Motion to Dismiss for Lack of Jurisdiction.
27 When a defendant moves to dismiss for lack of subject matter jurisdiction pursuant to
28 Federal Rule of Civil Procedure 12(b)(1), the plaintiff bears the burden of proving that the court
13
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 14 15
Page of of
16 17
1 has jurisdiction to decide the claim. Thornhill Publ’n Co. v. Gen. Tel. & Elecs. Corp., 594 F.2d
2 730, 733 (9th Cir. 1979). Federal courts can only adjudicate cases which the Constitution or
3 Congress authorize them to adjudicate: cases involving diversity of citizenship, or those cases
4 involving a federal question, or where the United States is a party. See, e.g., Kokkonen v.
5 Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994).
6 A Rule 12(b)(1) motion can be either “facial” or “factual.” Safe Air for Everyone v. Meyer,
7 373 F.3d 1035, 1039 (9th Cir. 2004). Where an attack on jurisdiction is a “facial” attack on the
8 allegations of the complaint, the factual allegations of the complaint are taken as true and the non-
9 moving party is entitled to have those facts construed in the light most favorable to him or her.
10 Federation of African Am. Contractors v. City of Oakland, 96 F.3d 1204, 1207 (9th Cir. 1996).
11 In a “factual attack,” the moving party questions the veracity of the plaintiff’s allegations
12 that “would otherwise invoke federal jurisdiction.” Safe Air for Everyone, 373 F.3d at 1039. The
United States District Court
13 plaintiff’s allegations are questioned by “introducing evidence outside the pleadings.” Leite v.
14 Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). “When the defendant raises a factual attack, the
15 plaintiff must support her jurisdictional allegations with ‘competent proof,’ under the same
Northern District of California
16 evidentiary standard that governs in the summary judgment context.” Id. (quoting Hertz Corp. v.
17 Friend, 559 U.S. 77, 96-97 (2010)). While the plaintiff typically has the burden of proof to
18 establish subject matter jurisdiction, “if the existence of jurisdiction turns on disputed factual
19 issues, the district court may resolve those factual disputes itself.” Id. at 1121-22 (citing Safe Air
20 for Everyone, 373 F.3d at 1039-40).
21 D. Envestnet’s Motion to Dismiss.
22 Envestnet moves to dismiss on the grounds that Plaintiffs fail to allege any misconduct by
23 it, but instead, seeks to hold Envestnet liable for Yodlee’s conduct. Envestnet argues that
24 Plaintiffs have not alleged sufficient facts to hold Envestnet liable under an alter ego theory.
25 While there is no “litmus test” for alter ego liability, there are “two general requirements:
26 (1) that there be such unity of interest and ownership that the separate personalities of the
27 corporation and the individual no longer exist and (2) that, if the acts are treated as those of the
28 corporation alone, an inequitable result will follow.” Mesler v. Bragg Mgmt. Co., 39 Cal. 3d 290,
14
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 15 16
Page of of
16 17
1 300 (1985) (citations omitted). “Alter ego is an extreme remedy, sparingly used.” Sonora
2 Diamond Corp. v. Sup. Ct., 83 Cal. App. 4th 523, 539 (2000); see also Katzir’s Floor & Home
3 Design, Inc. v. M-MLS.com, 394 F.3d 1143, 1149 (9th Cir. 2004) (quoting Dole Food Co. v.
4 Patrickson, 538 U.S. 468, 475 (2003) (“The doctrine of piercing the corporate veil, however, is the
5 rare exception, applied in the case of fraud or certain other exceptional circumstances.”). It may
6 be “invoked only where recognition of the corporate form would work an injustice to a third
7 person.” Tomaselli v. Transamerica Ins. Co., 25 Cal. App. 4th 1269, 1285 (1994) (emphasis in
8 original) (noting that “inadequate capitalization, commingling of assets, disregard of corporate
9 formalities” are “critical facts” to show an inequitable result would follow). “[W]hile the doctrine
10 does not depend on the presence of actual fraud, it is designed to prevent what would be fraud or
11 injustice, if accomplished.” Assoc. Vendors, Inc. v. Oakland Meat Co., 210 Cal.App.2d 825, 838
12 (1962). “Accordingly, bad faith in one form or another is an underlying consideration.” Id.
United States District Court
13 The Court may rely on the following factors to establish a unity of interest: commingling
14 of funds, identification of the equitable owners with domination and control of the two entities,
15 instrumentality or conduit for a single venture or the business of an individual, failure to maintain
Northern District of California
16 minutes or adequate corporate records, use of the same office or business locations, identical
17 equitable ownership of the two entities, use of a corporation as a mere shell, and the failure to
18 adequately capitalize a corporation. Id. Some courts have held that the pleading of at least two
19 factors in support of a unity of interest satisfies this element. See Pacific Maritime Freight, Inc. v.
20 Foster, 2010 WL 3339432, at *6 (S.D. Cal. Aug. 24, 2010) (citing authority that the identification
21 of unity of interest for alter ego liability plus two or three factors was held sufficient to defeat a
22 motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6)) (internal citations
23 omitted.
24 “California courts generally require evidence of some bad-faith conduct to fulfill the
25 second prong of alter-ego liability, [and] that bad faith must make it inequitable to recognize the
26 corporate form.” Smith v. Simmons, 638 F. Supp. 2d 1180, 1192 (E.D. Cal. June 23, 2009) (noting
27 that California courts generally require some evidence of bad faith before concluding that an
28 inequitable result justifies an alter ego finding); see also Associated Vendors, Inc. v. Oakland Meat
15
Case
Case 3:20-cv-05991-SK Document
4:20-cv-03056-DMR Document 54
122-1Filed 02/16/21
Filed 02/18/21Page 16 17
Page of of
16 17
1 Co., 210 Cal. App. 2d 825, 842 (1962) (“The purpose of the doctrine is not to protect every
2 unsatisfied creditor, but rather to afford him protection, where some conduct amounting to bad
3 faith makes it inequitable . . . for the equitable owner of a corporation to hide behind its corporate
4 veil.
5 Here, Plaintiffs have not yet alleged sufficient facts to proceed on their alter ego theory.
6 However, the Court will provide Plaintiffs with a limited time period to conduct discovery on this
7 issue. Therefore, the Court RESERVES RULING on Envestnet’s motion to dismiss pending this
8 discovery. The Court ORDERS that Plaintiffs may issue five document requests, five
9 interrogatories, and five requests for admission on this subject and take one deposition of
10 Envestnet pursuant to Fed.R.Civ.P. 60(b)(6). After conducting such discovery, by no later than
11 May 28, 2021, Plaintiffs shall file a supplemental brief with their supporting evidence to
12 demonstrate personal jurisdiction over Envestnet. Envestnet may file a supplemental response
United States District Court
13 brief by no later than June 11, 2021.
14 CONCLUSION
15 For the foregoing reasons, the Court GRANTS IN PART and DENIES IN PART Yodlee’s
Northern District of California
16 motion to dismiss and RESERVES RULING on Envestnet’s motion to dismiss. The Court
17 GRANTS Yodlee’s motion as to Plaintiffs’ claims under the Stored Communications Act claim,
18 the UCL, the CFAA, and the CDAFA, and DENIES Yodlee’s motion as to the remainder of
19 Plaintiffs’ claims. By no later than March 15, 2021, Plaintiffs may file an amended complaint to
20 cure the deficiencies addressed in this Order.
21 The Court STAYS all discovery against any defendant other than the limited discovery
22 regarding jurisdiction.
23 IT IS SO ORDERED.
24 Dated: February 16, 2021
25 ______________________________________
SALLIE KIM
26 United States Magistrate Judge
27
28
16
File and source
- File
- gov.uscourts.cand.359040.122.1.pdf
- Size
- 173,348 bytes
- SHA-256
- b54f810b5dbc64a7b00fa37103b2aafaf120ab43627f0b1d27a314680da129aa
- Original
- storage.courtlistener.com