Opinion
21-cv-1091-DWD
07-08-2022
CAROLYN BRIDGES, and RAYMOND CUNNINGHAM, individually and on behalf of all others similarly situated, Plaintiffs, v. BLACKSTONE GROUP, INC., Defendant. [1]
MEMORANDUM AND ORDER
DAVID W. DUGAN UNITED STATES DISTRICT JUDGE
Plaintiffs Carolyn Bridges and Raymond Cunningham bring this putative class action against Defendant Blackstone Group, Inc. alleging violations of the Illinois Genetic Information Privacy Act, 410 Ill. Comp. Stat. Ann. 513/1, et seq. ("GIPA") in connection with Blackstone's acquisition of non-party Ancestry.com DNA LLC. Plaintiffs filed an Amended Complaint seeking injunctive relief, statutory damages, and attorneys' fees (Doc. 22). Now before the Court is Defendant's motion to dismiss pursuant to Fed.R.Civ.P. 12(b)(6) (Doc. 30). Plaintiffs filed a memorandum in opposition (Doc. 34), to which Blackstone replied (Doc. 36). For the reasons detailed below, the Motion will be granted.
The Complaint
Plaintiffs allege the following facts, which for the purposes of this motion are taken as true. Hishon v. King & Spalding, 467 U.S. 69, 73 (1984) Plaintiffs are residents of Illinois (Doc. 22, ¶¶ 15-16). Plaintiffs purchased at-home DNA test kits from non-party, Ancestry.com LLC (“Ancestry") and provided their genetic material to Ancestry for sequencing (Doc. 22, ¶¶ 3, 22-35). In December 2020, Defendant Blackstone acquired Ancestry (Doc. 22, ¶ 4). In connection with the acquisition, Blackstone allegedly compelled the disclosure of Ancestry's “trove of DNA data", which included Plaintiffs' genetic testing data (Doc. 22, ¶¶ 4, 10, 52). Plaintiffs “never consented, agreed or gave permission-written or otherwise-to Ancestry to transfer their genetic testing and information derived from genetic testing to a third-party" or for Blackstone to take possession of their data (Doc. 22, ¶¶ 36, 37). Plaintiffs would not have provided their genetic information to Ancestry if they had known that Blackstone would compel its disclosure and take possession of their information without their consent (Doc. 22, ¶ 38).
Legal Standard
“To survive a motion to dismiss under Rule 12(b)(6), the complaint must provide enough factual information to state a claim to relief that is plausible on its face and raise a right to relief above the speculative level." Haywood v. Massage Envy Franchising, LLC, 887 F.3d 329, 333 (7th Cir. 2018) (internal quotations and citation omitted); see also Fed.R.Civ.P. 8(a)(2) (requiring a complaint to contain a “short and plain statement of the claim showing that the pleader is entitled to relief."). A plaintiff need not plead detailed factual allegations, but must provide “more than labels and conclusions, and a formulaic recitation of the elements." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). In reviewing the complaint, the Court must accept all well-pleaded factual allegations in the complaint as true and draw all reasonable inferences in Plaintiffs' favor. Fortres Grand Corp. v. Warner Bros. Ent. Inc., 763 F.3d 696, 700 (7th Cir. 2014).
Discussion
Plaintiffs assert that Blackstone compelled the disclosure of their genetic testing data from non-party Ancestry without Plaintiffs' written consent or knowledge (Doc. 22, ¶¶ 4, 10, 31, 52) and in violation of the Illinois Genetic Information Privacy Act, 410 Ill. Comp. Stat. Ann. 513/1, et seq. ("GIPA"). GIPA was designed to prevent employers and insurers from using genetic testing data as a means of discrimination for employment or underwriting purposes. As such, GIPA declared that "genetic testing and information derived from genetic testing" is "confidential and privileged" and placed restrictions on the ability to release that information. See 410 Ill. Comp. Stat. Ann. 513/15(a). GIPA also provides a private right of action for "[a]ny person aggrieved by a violation of this Act ... against an offending party." 410 Ill. Comp. Stat. Ann. 513/40(a).
Although originally enacted in 1998, GIPA has only been cited in a handful of cases. See, e.g., Big Ridge, Inc. v. Fed. Mine Safety & Health Rev. Comm'n, 715 F.3d 631, 657 (7th Cir. 2013); In re Ambry Genetics Data Breach Litig., 567 F.Supp.3d 1130 (C.D. Cal. 2021); Sekura v. Krishna Schaumburg Tan, Inc., 2018 IL App (1st) 180175, at ¶ 17; Melvin v. Big Data Arts, LLC, 553 F.Supp.3d 447 (N.D. Ill. 2021), Manor v. Copart Inc., No. 17-CV-2585, 2017 WL 4785924 (N.D. Ill. Oct. 24, 2017).
See, e.g., 410 Ill. Comp. Stat. Ann. 513/5(3) ("The public health will be served by facilitating voluntary and confidential nondiscriminatory use of genetic testing information."); 410 Ill. Comp. Stat. Ann. 513/20 (restricting insurers from seeking genetic testing for underwriting purposes); 410 Ill. Comp. Stat. Ann. 513/25 (restricting employers from requesting genetic testing or genetic testing information from employees and applicants or their family members). The best indicator of the legislature's intent is the language in the statute, which must be accorded its plain and ordinary meaning." Landis v. Marc Realty, L.L.C., 235 Ill.2d 1, 6 (2009).
Relevant to this matter, GIPA provides the following restrictions on the disclosure of genetic testing information:
[G]enetic testing and information derived from genetic testing is confidential and privileged and may be released only to the individual tested and to persons specifically authorized, in writing in accordance with Section 30, by that individual to receive the information.410 Ill. Comp. Stat. Ann. 513/15(a). Section 30 further provides:
No person may disclose or be compelled to disclose the identity of any person upon whom a genetic test is performed or the results of a genetic test in a manner that permits identification of the subject of the test [except to those persons found in Section 30(a)(1)-(6)].See 410 Ill. Comp. Stat. Ann. 513/30(a).
These persons generally include legally authorized representatives and employees of health care facilities. See 410 ILCS 513/30(a)(1)-(6). The parties do not argue that Defendant fits into one of these six-categories.
Blackstone denies that it compelled the disclosure of Plaintiffs' genetic testing information from Ancestry, and further denies that it ever obtained or received information protected by GIPA. Blackstone also maintains that GIPA does not provide a right of action against it, a purported recipient of genetic information, but instead argues that GIPA imposes liability on the wrongful discloser of that information. To that end, Blackstone insists that that even if it did somehow compel Ancestry to disclose information, the mere act of compelling under these circumstances is not a violation of GIPA (Doc. 30, p. 7). Plaintiff disagrees with this reading and argues that that limiting recourse generally to only the person disclosing the information would render the words “or be compelled to disclose" meaningless. (Doc. 34, p. 5).
The parties disagree on the interpretation of the following language:
No person may disclose or be compelled to disclose the identity of any person upon whom a genetic test is performed or the results of a genetic test in a manner that permits identification of the subject of this test.410 Ill. Comp. Stat. Ann. 513/30. A plain reading of this sentence suggests that the two phrases are complimentary but distinct. The first clause, “no person may disclose," prohibits a person possessing genetic testing data from improperly disclosing that data to another. The second clause, “no person may . . . be compelled to disclose," protects a person possessing genetic testing data from being compelled to disclose that data to another. While similar, the addition of the second clause ensures that individuals who undergo genetic testing are protected in two distinct ways: (1) by prohibiting third parties who possess their genetic data from improperly disclosing it, and (2) by shielding them from persons who seek to compel their genetic data for improper purposes. Accordingly, Section 30, in addition to the broad definition of “person", operates to ensure that any person in possession of genetic data (including both individuals undergoing genetic testing like Plaintiffs, and persons who obtained genetic data from those individuals, like Ancestry) are protected against others who mishandle genetic data by either improperly disclosing it or improperly compelling it.
“Persons" is broadly defined under the statute as “any natural person, partnership, association, joint venture, trust, governmental entity, public or private corporation, health facility, or other legal entity." 410 Ill. Comp. Stat. Ann. 513/10. The parties do not appear to dispute that both Ancestry and Blackstone would qualify as “persons" under GIPA.
The problem in this case, however, is that as alleged, Blackstone does not fit neatly into either category. Plaintiffs do not allege that Blackstone disclosed Plaintiffs' genetic data in violation of the first clause. Nor do Plaintiffs allege that Blackstone compelled Plaintiffs to disclose their data in violation of the second clause. Instead, Plaintiffs present a quasi-subrogation claim whereby Plaintiffs seek redress for Blackstone's compelling of Ancestrys alleged improper disclosure of data. Notably, Plaintiffs are not bringing a claim against Ancestry for its alleged part in improperly disclosing their data to Blackstone (See Doc. 22, ¶ 36) (Plaintiffs allege that they never gave Ancestry permission to disclose their data). However, in this case, Plaintiffs' personal data is the subject of the wrongful disclosure. As such, Plaintiffs seemingly qualify as “aggrieved persons" under GIPA's enforcement provision which permits “[a]ny person aggrieved by a violation of this Act [to] have a right of action . . . against an offending party." 410 Ill. Comp. Stat. Ann. 513/40(a).
While the Act does not define “person aggrieved", Plaintiffs urge the Court to adopt a similar broad reading of “aggrieved person" as used by the Illinois Supreme Court in interpreting a similar Illinois privacy statute, the Illinois Biometric Privacy Act (“BIPA"). See Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, at ¶ 40 (holding that “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under [BIPA] in order to qualify as an 'aggrieved' person" under the Act). Although the privacy statutes differ significantly in scope, they have identical enforcement provisions. See BIPA, 740 Ill. Comp. Stat. Ann. 14/20 (“Any person aggrieved by a violation of this Act shall have a right of action . . . against an offending party."); GIPA, 410 Ill. Comp. Stat. Ann. 513/40(a) ("Any person aggrieved by a violation of this Act shall have a right of action ... against an offending party."). In Illinois, "a statute should be construed in conjunction with other statutes touching on the same or related subjects considering the reason and necessity of the law, the evils to be remedied, and the objects and purposes to be obtained." Sekura, 2018 IL App (1st) 180175 (quoting Maschek, 2015 IL App (1st) 150520, ¶ 17 (internal markings and quotations omitted).
“Federal courts must defer to a state supreme court's interpretation of its own statutes" Stauffer v. Innovative Heights Fairview Heights, LLC, No. 3:20-CV-00046-MAB, 2020 WL 4815960 (S.D. Ill. Aug. 19, 2020), n. 5 (S.D. Ill. 2020) (citing Guaranty Bank v. Chubb Corp., 538 F.3d 587, 590 (7th Cir. 2008).
BIPA explicitly prohibits the disclosure or release of biometric data in addition to the prohibiting the receipt of such data. See 740 Ill. Comp. Stat. Ann. 14/15(b) (“No private entity may collect, capture, purchase, receive through trade, or otherwise obtain" biometric data without informed written consent"). Whereas the plain language of GIPA only prohibits the disclosure or compelled disclosure of genetic data.
These statutes are also similar in purpose and wording to the AIDS Confidentiality Act, 410 Ill. Comp. Stat. Ann. 305/13. See Sekura, 2018 IL App (1st) 180175 .
Here, the Court finds it appropriate to apply the definition of "aggrieved person" used by the Rosenbach court to GIPA. As the Rosenbach court reasoned, a broad reading of "aggrieved person" in BIPA is consistent with Illinois' understanding of the term "aggrieved", which has been frequently defined for decades as "having a substantial grievance; a denial of some personal or property right." Rosenbach, 2019 IL 123186, ¶ 30 (citing Glos v. People, 259 Ill. 332, 340 (1913)). Therefore, applying a similarly broad reading of "aggrieved person" here suggests that Plaintiffs, as the persons whose genetic data is the subject of the alleged wrongdoing, may seek redress against any "offending party" who compels the disclosure of their personal data, whether that "offending party" compels the data directly from Plaintiffs or from a non-party in possession of their data. As such, under these facts, Blackstone's position as the "compeller" of a non-party in possession of Plaintiffs' genetic data, does not summarily exclude it from liability under GIPA.
Notwithstanding the foregoing, the factual allegations in the Complaint fall short of alleging a violation of GIPA, and Plaintiffs have failed to state a viable claim of relief against Blackstone for at least two reasons. First, Plaintiffs have failed to allege that Blackstone's compelled Ancestry. Second, Plaintiffs have failed to allege that Blackstone otherwise received data that is protected by GIPA. Blackstone's alleged wrongdoing is predicated on its “compelling" of data from Ancestry. GIPA does not define “compelled." However, Defendant insists that the definition necessarily requires something more than receipt or obtainment. The Court agrees. When statutory terms are undefined, the Court strives to give those words their “ordinary and popularly understood meaning." Skaperdas v. Country Cas. Ins. Co., 2015 IL 117021; See also Kleber v. CareFusion Corp., 914 F.3d 480, 482 (7th Cir. 2019) (“If the statutory language is plain, we must enforce it according to its terms.") (citation omitted).
The parties propose various definitions of “compel", including: “[t]o cause or bring about by force, threats, or overwhelming pressure," (Doc. 30, p. 10) (citing Black's Law Dictionary (11th ed. 2019)); “to force or drive, especially to a course of action; to secure or bring about by force; to force to submit; subdue, to overpower; to use force; [or] to have a powerful and irresistible effect, influence etc." (Doc. 34, p. 7) (citing Compel, Dictionary.com, available at https:// www.dictionary.com/browse/compel (last accessed July 1, 2022). “To compel" is not ambiguous. Regardless, reviewing the proposed definitions offered by the parties, the definitions are not in conflict. Instead, it is clear that “to compel" means something more than passive receipt of information, and something more than merely “asking" or “requesting" another to take an action. However, at best, the Complaint alleges that Blackstone may have been entitled to request or receive information from Ancestry in connection with their acquisition, but that any information received was voluntarily given.
Plaintiffs argue in their briefing that Blackstone did assert some untoward influence or force over Ancestry because of Blackstone's wealth and alleged notorious reputation. However, these arguments do not appear in Plaintiffs' Complaint, and further ignore the specific allegations in the Complaint showing that Ancestry has a wealth and global reach comparable to Blackstone (Doc. 22, ¶¶ 2, 4, 25-26). Thus, suggesting that Blackstone held some coercive power over Ancestry merely because of Blackstone's wealth and reputation, is not plausibly supported or inferred from the allegations in the Complaint. Similarly, the other allegations in the Complaint cannot reasonably be construed to show that Blackstone compelled Ancestry to take any action. Throughout the Complaint Plaintiffs continuously cite to purported statements made by Blackstone. However, in reviewing the entirety of those statements, the statements contradict Plaintiffs' broad conclusory allegations and instead suggest the opposite of what Plaintiffs allege.
It is appropriate for the Court to review the entirety of the statements incorporated in the Complaint. Phillips v. Prudential Ins. Co. of Am., 714 F.3d 1017, 1020 (7th Cir. 2013) (Courts consider the well-pleaded factual allegations in a complaint, along with "documents attached to the complaint, documents that are .. referred to in it, and information that is subject to proper judicial notice."). When material in an exhibit contradicts the complaint's allegations, the exhibit controls. Id. ("To the extent that an exhibit attached to or referenced by the complaint contradicts the complaint's allegations, the exhibit takes precedence."); Forrest v. Universal Sav. Bank, F.A., 507 F.3d 540, 542 (7th Cir. 2007) ("A court is not bound by the party's characterization of an exhibit and may independently examine and form its own opinions about the document.").
For example, Plaintiffs state: “Defendant disclosed on Ancestry's website that customer's genetic information would be released and/or disclosed to Defendant for its own use"; and this genetic information was “paired with [the individual's] ... first and last name, email address, home address, and other information." (Doc. 22, ¶¶ 29-30). However, in reviewing the entirety of the statement cited (Doc. 22, ¶ 29, n.8), the Court observes that the statement is a multi-page overview of an update made to Ancestry's Privacy Statement and does not reference Blackstone at all. See https://www.ancestry.com/cs/legal/privacystatement (last accessed July 1, 2022). Moreover, the statement indicates that Ancestry would not share personal information or genetic information with third parties. Id. Further, in the event of an acquisition, Ancestry stated it might share personal information with the acquiring entity. Id. (Ancestry “may share ... Personal Information with the acquiring or receiving entity.") (emphasis added). However, Ancestry also stated that its promises as to privacy would continue to apply in the event of an acquisition. Id. (“The promises in this Privacy Statement will continue to apply to your Personal Information that is transferred to the new entity."). Thus, nothing in this privacy statement indicates that Blackstone made these representations on Ancestry's website. Nor does the statement indicate that Ancestry did or planned to share Plaintiffs' genetic information with Blackstone, for Blackstone's own use or otherwise.
Similarly, Plaintiffs allege that “Blackstone disclosed in regulatory filings that agreements to share information between its affiliated entities have already been implemented and that its effort to package and sell data to unaffiliated third-parties is underway." (Doc. 22, ¶ 28 at n.7). However, in reviewing the news article purporting to summarize these regulatory filings, Ancestry is not specifically mentioned (Doc. 30-3).Nor does the article refer to genetic testing data or information Id. The article also specifically quotes a Blackstone' representative, stating: "'[N]othing has been sold on behalf of our portfolio companies or Blackstone.' All data the firm's holdings generate "is fully anonymized and includes best-in-class privacy and compliance protections." Id. Accordingly, this article does not support Plaintiffs' broad conclusory allegation that Blackstone received genetic information from affiliated entities, like Ancestry, or was packaging or selling Plaintiffs' data to unaffiliated third parties. Therefore, even construing the allegations and statements broadly, the Complaint does not allege or infer that Blackstone compelled Ancestry to take any action.
The news article is available at https://www.bloomberg.com/news/articles/2020-12-15/blackstone-s-next-product-could-be-data-from-companies-it-buys (last accessed July 1, 2022). Defendant also provided a copy of the article at Doc. 30-3.
Moreover, even if Blackstone's actions were somehow compulsory, the Complaint also fails to allege that the purported information Blackstone received from Ancestry is information protected by GIPA. GIPA protects the disclosure or compelled disclosure of the "identity of any person upon whom a genetic test is performed or the result of a genetic test in a manner that permits identification of the subject of this test." See 410 Ill. Comp. Stat. Ann. 513/30(a). Plaintiffs allege that Blackstone obtained their genetic information, and that information was paired with their "first and last name, email address home address, and other information" (Doc. 22, ¶¶ 29-30). However, again, the actual documents Plaintiffs rely on contradict these conclusory statements. Thus, the Complaint fails to reasonably infer that the information Blackstone received from Ancestry, if any, identified Plaintiffs as individuals who had genetic tests performed or contained the results of Plaintiffs' genetic data such that Plaintiffs were identified as the subject of that data.
Conclusion
For these reasons, Plaintiffs' Amended Complaint fails to state a claim upon which relief may be granted. Because the complaint fails to state a claim, the Court declines at this time to reach Defendant's argument concerning whether GIPA applies extraterritorially. Defendant's Motion to Dismiss (Doc. 30) is GRANTED. Plaintiffs' Amended Complaint (Doc. 22) is DISMISSED without prejudice for a failure to state a claim. Plaintiffs are granted leave to file an amended complaint on or before August 1, 2022.
SO ORDERED.