Summary
finding that the public dissemination of personal information on defendant's websites, without plaintiff's consent, was a sufficiently concrete injury-in-fact
Summary of this case from Finlay v. MyLife.com Inc.Opinion
Case No. 1:14-cv-00004-SLG
06-30-2017
MICHAEL COLE, individually and on behalf of all others similarly situated, Plaintiff, v. GENE BY GENE, LTD., a Texas Limited Liability Company d/b/a FAMILY TREE DNA, Defendant.
ORDER RE MOTION TO DISMISS
Before the Court at Docket 95 is Defendant Gene by Gene's Motion to Dismiss Pursuant to Rule 12(b)(1) and 12(h)(3). Plaintiff Michael Cole opposed the motion at Docket 104, to which Gene by Gene replied at Docket 114. Oral argument was held on December 2, 2016.
BACKGROUND
The relevant facts for this motion are as follows: In 2013, Michael Cole purchased a DNA testing kit from www.familytreedna.com, a website operated by Gene by Gene. Testing kits include a cheek swab used to collect DNA samples and an optional release form to authorize the sharing of the customer's name and email address with his or her genetic matches. After swabbing their cheek, customers return the testing kits to Family Tree DNA for testing and storage. When testing is complete, Family Tree emails its customers a web link where they may view their results, locate genetic matches, and research their ancestral origins. Each customer is also given the option of joining projects. A project is an online forum run by an unpaid third-party volunteer; they are often operated through independent websites. When a customer joins certain projects, Mr. Cole alleges that Family Tree DNA automatically publishes the full results of the customer's DNA test to Family Tree DNA's publicly available websites. Mr. Cole signed up for nine projects and understood that the project administrators would have access to his name, contact information, and testing kit number. But Mr. Cole alleges that when he signed up for the projects, he was not informed that some project administrators had separate websites; nor was he informed that his full DNA test results would be disclosed on those sites.
Docket 1 (Compl.) at 9, ¶ 27.
Docket 1 at 7, ¶ 20. Gene by Gene does business as Family Tree DNA. The Court uses the names interchangeably.
Docket 1 at 7, ¶ 21.
Docket 1 at 7, ¶ 22.
Docket 1, at 8, ¶ 25. See Docket 105-1 (Cole Dep.) at 14 ("Well, my DNA test result was posted on Rootsweb, which is Ancestry.com."); see also Docket 106-2 at 10-11; Docket 106-4 at 8; Docket 106-5 at 2 ("[Family Tree DNA is] currently feeding results data directly to WorldFamilies, where it is then displayed publicly."). Gene by Gene vigorously disputes this claim. It maintains Mr. Cole's genetic information was not posted on any website. Docket 95 at 4 (citing Docket 96-1 at 11). Gene by Gene contends that it only lists repetition sequences of certain portions of "junk DNA" on its website. According to Gene by Gene, "junk DNA," or non-functional DNA, consists of non-exon segments of DNA. Genetic conditions are established by exons and therefore cannot be gleaned from non-functional DNA. Docket 95 at 6-7; Docket 110 (Greenspan Decl.) at 2 ¶ 3. The Court need not resolve this dispute at this time because (as explained below) Mr. Cole has adequately demonstrated specific facts plausibly satisfying Article III standing requirements. See Barnum Timber Co. v. EPA, 633 F.3d 894, 899 (9th Cir. 2011); see also Matera v. Google Inc., No. 15-cv-04062-LHK, 2016 WL 5339806 *6 (N.D. Cal. Sept. 23, 2016).
Docket 106-4 (Blankfeld Dep.) at 7.
Months later, after receiving excessive junk email, Mr. Cole searched the Internet for his email address and found it on a website called "Rootsweb." He alleges that he then learned his DNA test results had been publicly disclosed. Mr. Cole initiated this action against Gene by Gene, alleging that its sharing of his DNA test results violated Alaska's Genetic Privacy Act.
Docket 96-2 (Cloud Dep.) at 8.
See Docket 1 (citing AS 18.13.010 et seq.).
Mr. Cole brings this action on behalf of himself and a proposed class that includes all residents of Alaska who had their DNA results disclosed by Gene by Gene without written consent. Mr. Cole seeks the following relief from this Court: (1) an order certifying the class; (2) a declaration that Gene by Gene's conduct violates Alaska's Genetic Privacy Act; (3) an award of "actual and statutory damages" of $5,000, or, if the Court finds that Gene by Gene's alleged violation resulted in profit or monetary gain, $100,000; and (4) an injunction requiring Gene by Gene to cease disclosing its customers' DNA testing results.
Docket 1 at 10 (describing the putative class as "All citizens or residents of Alaska who had their DNA results disclosed, publically or to any third party, by Family Tree after joining one of its projects, for which Family Tree did not have a record of written consent to disclose the same"); see also Docket 138 (Mot. to Cert. Class).
AS 18.13.010 et seq.
The reference to actual damages in the Complaint's Prayer for Relief is somewhat ambiguous. See Docket 1 at 15. See also Docket 1 at ¶48 (Mr. Cole asserts that he suffered damgages in an amount equal to the difference between the price he paid to Gene by Gene and the price he would have been willing to pay had he known that his full DNA test results would be disclosed.) But in subsequent responses to discovery and in his filings on this motion, it appears clear that Mr. Cole is seeking solely to recover the statutory penalty under Alaska's Genetic Privacy Act.
Docket 1 (Compl.) at 15.
DISCUSSION
I. Statutory Jurisdiction
Mr. Cole and Gene by Gene are residents of different states and the amount in controversy exceeds the requisite $75,000. Therefore, this Court has jurisdiction pursuant to 28 U.S.C. § 1332. Under diversity jurisdiction, the Court applies federal procedural law and Alaska substantive law. II. Motion to Dismiss
Gene by Gene has moved to dismiss this action pursuant to Federal Rule of Civil Procedure 12(b)(1). Specifically, Gene by Gene maintains that since Mr. Cole is seeking only statutory damages under the Genetic Privacy Act, he has not demonstrated the requisite injury-in-fact for Article III standing. Lack of Article III standing requires dismissal for want of subject matter jurisdiction under Rule 12(b)(1).
See Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011).
"A Rule 12(b)(1) jurisdictional attack may be facial or factual." In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction. Gene by Gene's jurisdictional attack is factual because it relies on evidence beyond the pleadings to refute Mr. Cole's contention that he has the requisite injury-in-fact sufficient to confer standing.
Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004) (citing White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000)).
Morrison v. Amway Corp., 323 F.3d 920, 924 n.5 (11th Cir. 2003) (finding jurisdictional challenge a factual attack when it "relied on extrinsic evidence and did not assert lack of subject matter jurisdiction solely on the basis of the pleadings").
When a defendant has moved to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1), the plaintiff bears the burden of establishing the Court's jurisdiction. The plaintiff carries that burden by putting forth "the manner and degree of evidence required" by whatever stage of the litigation the case has reached. At the motion to dismiss stage, a plaintiff must allege specific facts that demonstrate the standing requirements are met. In determining whether the plaintiff has met his burden, "the court may expand its review and 'rely on affidavits or any other evidence properly before the court.'"
Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016) (citing FW/PBS, Inc. v. Dallas, 493 U.S. 215, 231 (1990)).
Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992).
Barnum Timber Co. v. EPA, 633 F.3d 894, 899 (9th Cir. 2011); see also Matera v. Google Inc., No. 15-cv-04062-LHK, 2016 WL 5339806 *6 (N.D. Cal. Sept. 23, 2016).
Corrie v. Caterpillar, Inc., 503 F.3d 974, 980 (9th Cir. 2007) (quoting St. Clair v. City of Chico, 880 F.2d 199, 201 (9th Cir. 1989)).
To establish standing to sue, a plaintiff "must demonstrate three elements which constitute the 'irreducible constitutional minimum' of Article III standing." First, a plaintiff "must have suffered an 'injury-in-fact' to a legally protected interest that is both 'concrete and particularized' and 'actual or imminent, as opposed to conjectural or hypothetical.'" Second, "there must be a causal connection between [the plaintiff's] injury and the conduct complained of." Third, "it must be 'likely'—not merely 'speculative'—that [the] injury will be 'redressed by a favorable decision.'" In the class action context, "standing is satisfied if at least one named plaintiff meets the[se] [three] requirements." Gene by Gene focuses on the first requirement for Article III standing, asserting that Mr. Cole lacks standing because he has no evidence of any actual injury.
San Diego Cnty. Gun Rights Comm. v. Reno, 98 F.3d 1121, 1126 (9th Cir. 1996) (quoting Lujan, 555 U.S. at 560).
Id. (quoting Lujan, 555 U.S. at 560-61).
Bates v. United Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007) (en banc) (citing Lujan, 504 U.S. at 560-61).
See Docket 96-1 at 15-16 (Cole Depo.) ("Q: Do you have any evidence that you have suffered any negative insurance consequences as a result of disclosure? A: No. Q: Do you have any evidence that you have suffered any negative healthcare consequences as a result of the disclosure? A: No. Q: Do you have any evidence that you have sustained any negative educational consequences as a result of the disclosure? A: No.").
Mr. Cole's asserted injury is based exclusively on alleged violations of Alaska's Genetic Privacy Act. AS 18.13.010(a) of the Act provides as follows:
See, e.g., Docket 96-1 (Cole Dep.) at 14, 16.
(1) a person may not collect a DNA sample from a person, perform a DNA analysis on a sample, retain a DNA sample or the results of a DNA analysis, or disclose the results of a DNA analysis unless the person has first obtained the informed and written consent of the person, or the person's legal guardian or authorized representative, for the collection, analysis, retention, or disclosure;The Act also creates a private right of action:
(2) a DNA sample and the results of a DNA analysis performed on the sample are the exclusive property of the person sampled or analyzed.
A person may bring a civil action against a person who collects a DNA sample from the person, performs a DNA analysis on a sample, retains a DNA sample or the results of a DNA analysis, or discloses the results of a DNA analysis in violation of this chapter. In addition to the actual damages suffered by the person, a person violating this chapter shall be liable to the
person for damages in the amount of $5,000 or, if the violation resulted in profit or monetary gain to the violator, $100,000.
AS 18.13.020.
At issue is whether the alleged violation of this statute is sufficient to confer Article III standing. A legislature may elevate injuries that were "previously inadequate in law" to "the status of legally cognizable injuries." But not every harm recognized by statute will be sufficiently "concrete" for standing purposes.
Spokeo, 136 S. Ct. at 1549 (citing Lujan, 504 U.S. at 578).
When evaluating whether a statutory violation constitutes an injury-in-fact, Spokeo instructs courts to consider two factors: (1) whether the alleged intangible harm caused by the statutory violation bears a "close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts," and (2) congressional judgment in establishing the statutory right.
Matera, 2016 WL 5339806, at *9 (citing Spokeo, 136 S. Ct. at 1549).
Mr. Cole's alleged harm satisfies Spokeo's first factor. Alaska's Genetic Privacy Act recognizes an exclusive property interest in one's DNA, and prohibits the unauthorized disclosure of DNA information. These statutory entitlements bear a close relationship to the common law torts of conversion of property and invasion of privacy, which have each historically provided a basis for a lawsuit in American courts. The Ninth Circuit has stated that "constitutionally protected privacy interest" may be violated by "disclosure of personal matters." Likewise, Alaska Supreme Court decisions demonstrate that "the right of privacy embodied in the Alaska Constitution is implicated by the disclosure of personal information about oneself." Accordingly, Mr. Cole's alleged injury is closely related to torts that have been recognized in both federal and Alaska state courts.
See Restatement (First) of Torts § 232 (1934); Restatement (Second) of Torts § 652A.
Norman-Bloodsaw v. Lawrence Berkeley Lab., 135 F.3d 1260, 1269 (9th Cir. 1998).
Doe v. Alaska Super. Ct., Third Jud. Dist., 721 P.2d 617, 629 (Alaska 1986) (emphasis in original).
As to the second factor, congressional judgment, three considerations favor finding that the statute grants persons in the plaintiff's position a right to judicial relief: (1) the provision of a private right of action; (2) the availability of statutory damages; and (3) the substantive nature of the statutory right. Each of those considerations weigh in favor of Article III standing here. First, Alaska's Genetic Privacy Act explicitly grants a private right of action to those aggrieved by a violation of the act. Second, the Genetic Privacy Act expressly provides for the recovery of statutory damages in addition to any actual damages suffered. Third, the Act creates a property interest in one's DNA and the results of any DNA analysis. By creating such an interest, the Alaska legislature did more than mandate specific procedural requirements; it created a substantive right. Accordingly, the unauthorized disclosure of an individual's DNA is not hypothetical or uncertain; it constitutes a concrete harm that satisfies the injury-in-fact requirement under Article III.
See Matera, 2016 WL 5339806, at *12. Regarding this third consideration, in Spokeo, the Supreme Court observed that while "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact," a "bare procedural violation, divorced from any concrete harm" is not. Spokeo, 136 S. Ct. at 1549.
AS 18.13.010 ("[A] DNA sample or the results of a DNA analysis performed on the sample are the exclusive property of the person sampled or analyzed." (emphasis added)).
See, e.g., Van Patten v. Vertical Fitness Grp., LLC, 847 F.3d 1037, 1043 (9th Cir. 2017) ("The TCPA establishes the substantive right to be free from certain types of phone calls and texts absent consumer consent."); Syed v. M-I, LLC, 853 F.3d 492, 499 (9th Cir. 2017) (finding a concrete injury when employer willfully procured applicant's credit report using illegal disclosure and authorization form).
The Complaint also adequately alleges this injury was caused by Gene by Gene's conduct and could be remedied by an award of statutory damages, thus establishing the remaining two standing requirements.
For the reasons stated above, the Court concludes that although Mr. Cole's alleged injury—the dissemination of his DNA test results without his consent—may not have resulted in tangible economic or physical harm, the injury is sufficiently "concrete" so as to confer Article III standing. Accordingly, Mr. Cole has standing to bring this action, and the Court hereby DENIES Gene by Gene's motion to dismiss at Docket 95.
Mr. Cole also argues that he suffered a tangible injury to his property rights. See Docket 104 at 12. However, the Court need not decide whether Mr. Cole's alleged injury was tangible or intangible; it is sufficient that the asserted injury constitutes a concrete injury under Article III. --------
DATED this 30th day of June, 2017.
/s/ Sharon L . Gleason
UNITED STATES DISTRICT JUDGE