Rocky Mountain Bank -v- Google, Inc.

Filing 18

REDACTION to 1 Complaint by Rocky Mountain Bank re 1 Complaint (Attachments: # 1 Verification) (bw, COURT STAFF) (Filed on 9/22/2009) Modified on 9/22/2009 (bw, COURT STAFF). Modified on 9/23/2009,(Incorrect event selected. Correct event to be used is Redaction.) (cv, COURT STAFF).

Rocky Mountain Bank -v- Google, Inc.

Doc. 18

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page1 of 9

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

GRACE Y. HOROUPIAN (SBN 180377) KUTAK ROCK LLP Suite 1100 18201 Von Karman Avenue Irvine, CA 92612-1077 Telephone: [phone] Facsimile: [phone] Email: [e-mail] NEIL L. ARNEY (SBN 125682) KUTAK ROCK LLP Suite 3100 1801 California Avenue Denver, CO 80202 Telephone: [phone] Facsimile: [phone] Email: [e-mail] Attorneys for Plaintiff ROCKY MOUNTAIN BANK, a Wyoming corporation UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA ROCKY MOUNTAIN BANK, a Wyoming corporation, Plaintiff, v. GOOGLE INC., a Delaware corporation, Defendant. Case No. VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF (FILED UNDER SEAL) [REDACTED]

VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

Dockets.Justia.com

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page2 of 9

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

Plaintiff Rocky Mountain Bank, by and through its attorneys Kutak Rock LLP, hereby submits the following Verified Complaint for Declaratory and Injunctive Relief against Defendant Google Inc., in support thereof, states and alleges as follows: PARTIES 1. 2. Plaintiff Rocky Mountain Bank (the "Bank") is a Wyoming Defendant Google Inc. ("Google") is a Delaware corporation with its corporation with its principal place of business in Wilson, Wyoming. principal place of business in Mountain View, California. Plaintiff and Defendant are collectively referred to as the "Parties." JURISDICTION AND VENUE 3. Jurisdiction is proper in this Court pursuant to 28 U.S.C. § 1332 on the grounds that the amount in controversy exceeds $75,000, exclusive of interest and costs, and the controversy is between citizens of different states. For purposes of diversity, the Bank is a citizen of Wyoming, since it is incorporated in Wyoming and has its principal place of business in Wyoming. Upon information and belief, Defendant Google is a citizen of the States of California and Delaware because its principal place of business is in California and it is incorporated in Delaware. 4. District. 5. 6. 7. Venue is proper in this District under 28 U.S.C. § 1391(a)(1) and (3). GENERAL ALLEGATIONS The Bank is a full service banking institution which, among other On August 12, 2009, the Bank received a telephone call from a things, offers various loans to individual consumers and corporate entities. This Court may exercise personal jurisdiction over Google because, among other things, Google's principal place of business is in California and in this

27 customer (the "Customer"), wherein the Customer requested that the Bank send 28 certain annual loan statements via e-mail (the "Requested Information") to a thirdVERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

-2-

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page3 of 9

1 party representative of the Customer (the "Request"). 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

8.

In connection with the Request, on August 12, 2009, at approximately

4:13 p.m., an employee of the Bank attempted to send the Customer's representative the Requested Information via e-mail. 9. At approximately 7:22 p.m., the Customer's representative informed the Customer, via email, that he had not received the Requested Information. The Customer forwarded the email to an employee of the Bank at approximately 7:50 p.m. 10. On August 13, 2009, an employee of the Bank discovered that the The e-mail was sent to the following address: Requested Information was inadvertently sent to the wrong email address (the "Inadvertent Email"). "[Redacted]@gmail.com" (the "Gmail Account"), which is an account that was set up and maintained through www.google.com. Additionally, the Bank discovered that the information that was attached to the Inadvertent Email contained Confidential Customer Information relating to 1,325 individual and business customer accounts (the "Customer Accounts"), i.e., for customers other than just the Customer who requested information. 11. The customer information that was attached to the Inadvertent E-Mail included names, addresses, tax identification numbers and loan information for each of the 1,325 customer accounts. The attached information is confidential information of the Bank's customers and to which the Bank's customers have a right to privacy (hereinafter the "Confidential Customer Information"). 12. Because of the inadvertent disclosure of the Confidential Customer Information, state and federal regulations require the Bank to make a prompt and good faith investigation to determine the likelihood that the Confidential Customer Information has been or will be misused. The reason for this investigation is to ascertain if the privacy rights of the Customers are protected. 13. After learning of the inadvertent disclosure of Confidential Customer
VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

-3-

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page4 of 9

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Information, the Bank immediately attempted to recall the Inadvertent Email, which was sent using Microsoft Outlook. However, the Bank's efforts to recall the Inadvertent Email were not successful. The Bank is advised that the recipient of the email must also be using Microsoft Outlook to recall an email. Further, the Bank is advised that, if the Inadvertent Email had already been opened, a recall attempt would be futile. 14. On August 13, 2009, at approximately 1:57 p.m., Mark Hendrickson, the President of the Bank, sent an email to the Gmail Account, whereby Mr. Hendrickson instructed the recipient to immediately delete the Inadvertent Email and the file attached thereto in its entirety without opening or reviewing it. Mr. Hendrickson also requested that the recipient immediately contact the Bank to discuss his/her actions. As of the date of this Complaint, the Bank has not received a response from the Gmail Account holder. 15. In an effort to determine whether the Gmail Account is a valid, active email address, on or about August 13, 2009, an employee of the Bank attempted to register the email address through Google.com. The Bank employee was unable to register the address. Therefore, the Bank concluded that Gmail Account was a valid Google email address. 16. The Bank believes and understands that Google has information regarding the Gmail Account holder, and regarding the status and activity level of the Gmail Account. The Bank also believes that Google has the ability to freeze the Gmail Account and to take other steps to prevent access to and dissemination of the inadvertently disclosed Confidential Customer Information. Accordingly, in further efforts to protect the Confidential Customer Information, both the Bank and the Bank's undersigned counsel contacted Google's legal support via email and informed Google that Confidential Customer Information was sent to one of its "gmail" accounts and inquired as to whether the account was active or dormant and what steps could be taken to ensure that the Confidential Customer Information was
VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

-4-

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page5 of 9

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

not used or disclosed. However, Google advised the Bank and undersigned counsel that it would not provide any information regarding the Gmail Account and would not otherwise assist in preventing disclosure of the Confidential Customer Information except and unless it was requested through "a valid third-party subpoena or other appropriate legal process." 17. In connection with the Bank's internal investigation and evaluation of the likelihood that the Confidential Customer Information has been or will be misused, the Bank has determined that it is necessary to: (a) prevent Google or the Google account holder from using the Confidential Customer Information; (b) have the Gmail Account immediately frozen or deactivated to prevent any access to the Confidential Customer Information; (c) delete the Inadvertent Email from Google's system; (d) determine the status of the Gmail Account, specifically, whether the Gmail Account is active or dormant and whether the Inadvertent Email was opened or otherwise manipulated by the account holder; and (e) in the event that the Gmail Account is not dormant, ascertain the identity of the Gmail Account holder, so that the Bank can take appropriate steps with the account holder to ensure that the Confidential Customer Information is not distributed or otherwise misused. 18. In connection with the Bank's internal investigation, on September 1, 2009 the Bank notified the Wyoming Division of Banking and the Tenth Federal Reserve District (collectively, the "Regulators") of the Inadvertent Email and the steps the Bank had taken and planned to take to protect its customer information. The Regulators confirmed that the Bank was taking proper steps in connection with the Inadvertent Email and agreed that the Bank must take action to have the Gmail Account frozen and/or determine the status of the Gmail Account.
/// /// /// ///
VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

-5-

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page6 of 9

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

FIRST CAUSE OF ACTION (Declaratory Relief) 19. 20. The Bank incorporates the allegations of paragraphs 1 through 18 The Bank and its Regulators believe it is imperative for the Bank to

inclusive, as if fully set forth herein. obtain information regarding the Gmail Account and stop access to the Confidential Customer Information in order to protect the privacy rights of the Bank's Customers whose information was inadvertently disclosed. 21. The Bank has requested information from Google regarding the Gmail Account and has requested Google's assistance in preventing further disclosure of the Confidential Customer Information. Google, however, has refused to disclose any information to the Bank or to assist the Bank in its efforts to prevent disclosure of the Confidential Customer Information, unless and until it is subject to legal process. 22. Because of Google's refusal to provide information or other assistance to the Bank that is necessary to protect confidential information of the Bank's customers, there is a dispute between the parties. 23. The Bank, therefore, requests a declaration that, in connection with its efforts to protect the Confidential Customer Information, it is entitled to the information requested concerning the Gmail Account, specifically, whether the Gmail Account is active or dormant, whether the Inadvertent Email was opened or otherwise manipulated; and in the event that the Gmail Account is not dormant, the identity of the Gmail Account holder. In addition, the Bank requests a declaration that Google is required to take all reasonable steps to ensure that the Confidential Customer Information is not accessed, used or distributed, including, but not limited to, deactivating the Gmail Account and deleting the Inadvertent Email from its system.
-6-

VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page7 of 9

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

SECOND CAUSE OF ACTION (Injunctive Relief) 24. 25. The Bank incorporates the allegations of paragraphs 1 through 23 Injunctive relief is warranted because the Bank has no plain, speedy

inclusive, as if fully set forth herein. and adequate remedy at law to prevent disclosure or misuse of the Confidential Customer Information. 26. The Bank is likely to prevail on the merits of its claims, or at a minimum, there is a serious question going to the merits of the Bank's claim, and the balance of the equities tip decidedly in favor of issuing injunctive relief in favor of the Bank. 27. 28. The granting of injunctive relief preventing the unlawful use of Based on the foregoing, the Bank is entitled to a temporary restraining Confidential Customer Information will serve the public interest. order, a preliminary injunction, and a permanent injunction: (a) restraining and permanently enjoining Google and its account holder from accessing, distributing, or using the Confidential Customer Information; (b) requiring Google to immediately deactivate the Gmail Account or any other steps within its power to prevent access to the Gmail Account; (c) requiring Google to delete the Inadvertent Email and the Confidential Customer Information from its system; (d) requiring Google to immediately disclose the status of the Gmail Account; specifically, whether the Gmail Account is active or dormant and whether the Inadvertent Email was opened or otherwise manipulated by the account holder; and (e) in the event that the Gmail Account is not dormant, requiring Google to disclose all information that it has regarding the Gmail Account holder to allow the Bank to prevent the account holder from using or distributing the Confidential Customer Information

VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

-7-

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page8 of 9

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

PRAYER FOR RELIEF WHEREFORE, Plaintiff Rocky Mountain Bank prays that judgment be entered in its favor and against Defendant Google Inc. on the claims asserted herein and that it be awarded the following relief: 1. A declaration that it is entitled to the information concerning the Gmail Account; specifically, whether the Gmail Account is active or dormant, whether the Inadvertent Email was opened or otherwise manipulated; and in the event that the Gmail Account is not dormant, the identity of the Gmail Account holder. 2. A declaration that Google is required to take all reasonable steps to ensure that the Confidential Customer Information is not accessed, used or distributed, including, but not limited to, deactivating the Gmail Account and deleting the Inadvertent Email and the Confidential Customer Information from its system. 3. A temporary restraining order, preliminary injunction, and permanent a. b. c. Google and the Gmail Account holder are enjoined from Google immediately deactivate the Gmail Account and delete Google immediately disclose the status of the Gmail Account, injunction, ordering that: accessing, using, or distributing the Confidential Customer Information; the Inadvertent Email and attachment from its system; specifically, whether the Gmail Account is dormant or active, whether the Inadvertent Email was opened or otherwise manipulated, and in the event that the Gmail Account is not dormant, the identity and contact information for the Gmail Account holder. 4. Any other and further relief the Court deems just and proper under the circumstances.

VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

-8-

Case5:09-cv-04385-JW Document18

Filed09/22/09 Page9 of 9

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Respectfully submitted this 17th day of September, 2009. KUTAK ROCK LLP

By: /s/ Grace Y. Horoupian Grace Y. Horoupian ATTORNEYS FOR PLAINTIFF ROCKY MOUNTAIN BANK Plaintiff's Address: Rocky Mountain Bank Pinedale 145 E. Pine Street Pinedale, WY 82941

VERIFIED COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF CASE NO. __________
4834-1520-0516.1

-9-