American Banker, "Lawsuit: Lendistry, Plaid and Qualified violated consumer data rights" Nov. 6, 2024 — allegations;...
Cited in: Everett Sands · Lendistry
Full text
Data privacy Lawsuit: Lendistry, Plaid and Qualified violated consumer data rights By Penny Crosman About Penny pennycrosman mailto penny.crosman@arizent.com pennycrosman Published November 06, 2024, 2:36 p.m. EST | Updated November 06, 2024, 6:47 p.m. EST 6 Min Read A Los Angeles accounting firm has sued online lender Lendistry, saying the company violated several California laws, including data privacy laws, in its administration of a state-funded grant program to California businesses. The lawsuit alleges Lendistry collected and shared grant applicants' sensitive personal and financial information without their knowledge or consent. Many of the data privacy violations involve Lendistry's tech partners, Plaid and Qualified, though they are not named as defendants. Processing Content The complaint is sweeping and it accuses Lendistry of failing to protect customer data in the course of several practices common to lenders, including the use of data aggregators to gather bank account data; the use of AI to analyze chatbot conversations, call center conversations and bank account data; and the use of tracking cookies. The suit comes shortly after the Consumer Financial Protection Bureau finalized its Personal Financial Data Rights rule, sometimes called the open banking rule, which puts restrictions around such data sharing. The lawsuit is about "Lendistry's sharing with and use of confidential business data to undisclosed third-parties via artificial intelligence and advanced machine learning technologies," said J.R. Howell, the attorney who filed the claim, in an email interview. "Lenders need to be aware that when they bring these technologies into their client relationships, they may be providing a backdoor to allow others to harvest their clients' data, running afoul of privacy laws that have been on the books for decades." Lendistry says it will fight this lawsuit. "Lendistry takes appropriate steps to protect the privacy of our customers' information," a spokeswoman said. "We deny the allegations in the complaint and intend to vigorously defend against these baseless claims." It is important that customers be informed of how their data will be used, said Aaron McPherson, principal at AFM Consulting Partners. "The new open banking rule from the CFPB specifically prohibits what it calls 'secondary use' to prevent unintended uses like this from taking place," McPherson said. Once the CFPB rule takes effect, "assuming it is not struck down by a court, I do think we will see more lawsuits like this taking place." Onisko & Scholz, the accounting firm that brought the suit, applied for a state COVID-19 relief grant through Lendistry in June 2023. Lendistry is a minority-led small-business lender in Los Angeles that last year was the No. 1 African American-led lender in the Small Business Administration 7(a) program. Lendistry's legal name is B.S.D. Capital. Some of the allegations involve the grant itself. For instance, the firm says it was entitled to a grant of more than $30,000, but it received only $5,000 from Lendistry. (Onisko & Scholz did not respond to a request for comment.) But much of the complaint is about the alleged misdeeds of Lendistry's tech partners, especially Plaid, its third-party verification provider, and Qualified, its customer-facing chatbot provider. According to the complaint, both companies harvest customer data and use it for their own unauthorized purposes. For instance, according to the complaint, Onisko & Scholz gave Plaid its online banking credentials to verify its bank account information, in what the accounting firm thought was going to be a one-time data call. Instead, the complaint says, Plaid logged in "multiple times a day every day thereafter for the purpose of harvesting data." Plaid declined a request for comment. Plaid "has acknowledged the frequency of its data harvesting activities," said Howell, the attorney who filed the complaint. "What was not disclosed to the businesses that used Lendistry's services to access funding was the nature and extent of this access or how to limit the access." Disclosure and consent of these activities along with a structure to manage permissions can help lenders and business clients protect confidential business information, he said. "The problem here is that Lendistry's user interface implied that such a permission structure existed while also representing that the business users' data was safe, secure and protected with encryption," Howell said. The complaint also says Plaid "exploits the information obtained in this manner in a variety of ways, including marketing the data to its own customers, analyzing the data to derive insights into user behavior, and, most recently, selling its collection of data to Visa as part of a multibillion-dollar acquisition." Visa and Plaid announced a plan to merge in 2020. The two companies dropped the plan a year later, after a challenge from the Department of Justice. In Howell's view, Visa's interest in Plaid's customer data shows how valuable it is. "While the merger was abandoned after the DOJ Antitrust Division's investigation, Visa's acquired stake via Plaid's Series C funding was based on a multibillion-dollar valuation," he said. "The point here is to inform the courts and the public that there is a large market for the type of data at issue and there are sizable players vying for data access. As more businesses become aware that their confidential data is valuable to participants in data markets, they need to consider appropriate safeguards to ensure their privacy is protected in their own business relationships, like those with their lenders." Past lawsuits have accused Plaid of seeing the customer data it aggregates on its clients' behalf, and the company has consistently denied it. "Plaid does not sell and has never sold consumers' personal information or data," a company spokeswoman said in response to a 2020 suit brought by Venmo customers James Cottle and Frederick Schoeneman. "Consumer data is obtained and used with consumer consent. Plaid believes strongly that consumers should have permission-based access to and control over their financial data, and embodies these principles in its practices." Online banking Amazon partners with Lendistry to expand small-business loan program September 29, 2022 3:29 PM The complaint also calls out Lendistry's use of an AI chatbot provided by Qualified to answer customers' questions. Qualified uses machine learning software to analyze the communications for behavioral and biometric information, the complaint said. "Qualified creates transcripts of the conversations to be aggregated with the behavioral data and other identifying information, and subsequently monetized and used in other capacities for the benefit of Qualified and other third-parties with whom Qualified does business without disclosure or consent to the users," the complaint stated. Lendistry users are not told that Qualified is intercepting the communications, or how Qualified uses their information, according to the complaint. Qualified did not respond to a request for comment. Qualified's AI system "trains itself on the communications, which become a part of the product/service itself, and which increases the value of the AI and the company that owns it — making it into a more and more valuable product," the complaint stated. The complaint further said Lendistry lets a third party capture inbound and outbound calls in its call center — something many companies across industries do. These conversations can involve sensitive and private information, including passwords, business payroll data and wage and salary information. "All of this information is intercepted by a third-party and used for incorporation into AI models for a third-party's independent uses," the complaint stated, without consent. Penny Crosman Executive Editor, Technology at Arizent Penny Crosman is Executive Editor, Technology at American Banker. She is based in New York. She guides technology coverage at American Banker and... Read full bio mailto Data privacy Technology M&A Keweenaw Financial plans to acquire neighboring Range Financial in a transaction that would create an institution with nearly $1.7 billion of assets. By John Reosti Reporter 9h ago In 2024, a Honduras-born man who was buying a motorcycle was turned down for a loan. Two years later, Truist Financial is facing a discrimination lawsuit — and the plaintiff's lawyer says many lenders are vulnerable to the same accusations. By Nathan Place National Reporter 9h ago Federal Reserve The nation's largest banks saw their aggregate capital levels decline the least since the stress testing regime was reformed in 2020. Even so, the Fed will keep stress capital buffers unchanged as it weighs structural changes to its annual capital test. By Kyle Campbell Staff writer 10h ago Commercial banking The Atlanta-based parent company of Ameris Bank plans to open a commercial banking office in Tennessee's largest city by the end of the year, as part of its organic growth strategy. By Allissa Kline Reporter 10h ago Wealth management The head of client segments in Morgan Stanley's wealth division acknowledges AI could one day be the primary source of financial advice for mass affluent clients. Morgan Stanley advisors working with wealthier investors will have to up their games. By Dan Shaw Reporter 10h ago Trump administration The Senate Banking Committee is slated to consider Christopher Phelen to be the chair of the Council of Economic Advisers on Thursday. Phelen has said in past academic papers that fractional reserve banking is "highly problematic." By Claire Williams Reporter 11h ago
File and source
- File
- lawsuit-lendistry-plaid-and-qualified-violated-consumer-data-rights_d9f08398086f1c9a.html
- Size
- 275,987 bytes
- SHA-256
- 82334af5da6ebdab32f5ee35968804e16dab5f5dd894a0b32bb92158233d8d70
- Original
- www.americanbanker.com