Opinion
No. 22-2486
05-01-2023
Carolyn BRIDGES and Raymond Cunningham, Plaintiffs-Appellants, v. BLACKSTONE, INC., Defendant-Appellee.
Kyle Alan Shamberg, Attorney, Lynch Carpenter LLP, Chicago, IL, Gregory L. Shevlin, Attorney, Cook, Bartholomew, Shevlin, Cook & Jones, LLP, Belleville, IL, Jonathan Marc Jagher, Attorney, Freed Kanner London & Millen, LLC, Conshohocken, PA, for Plaintiffs-Appellants. Martin Louis Roth, Amelia Bailey, Alyssa Kalisky, Attorneys, Kirkland & Ellis LLP, Chicago, IL, for Defendant-Appellee.
Appeal from the United States District Court for the Southern District of Illinois. No. 3:21-cv-1091 — David W. Dugan, Judge. Kyle Alan Shamberg, Attorney, Lynch Carpenter LLP, Chicago, IL, Gregory L. Shevlin, Attorney, Cook, Bartholomew, Shevlin, Cook & Jones, LLP, Belleville, IL, Jonathan Marc Jagher, Attorney, Freed Kanner London & Millen, LLC, Conshohocken, PA, for Plaintiffs-Appellants. Martin Louis Roth, Amelia Bailey, Alyssa Kalisky, Attorneys, Kirkland & Ellis LLP, Chicago, IL, for Defendant-Appellee. Before Hamilton, Scudder, and Pryor, Circuit Judges. Scudder, Circuit Judge.
Carolyn Bridges and Raymond Cunningham provided their DNA to Ancestry.com, the largest genealogy company in the world. A few years later, Blackstone, Inc. acquired Ancestry in a deal reportedly worth $4.7 billion. Bridges and Cunningham filed this putative class action against Blackstone, alleging that the acquisition resulted in a violation of Illinois's Genetic Information Privacy Act. The district court concluded that Bridges and Cunningham failed to state a claim. We agree and affirm.
I
Many courts have developed great familiarity with Illinois's privacy protection provisions in recent years. Most notably, the General Assembly enacted the Biometric Information Privacy Act in 2008, which has been the subject of many decisions in our court and made the acronym BIPA commonplace. Less known and litigated, however, is Illinois's Genetic Information Privacy Act, which went into effect in 1998. Drawing on these two statutes' privacy-centric similarities, the parties refer to this latter statute as GIPA.
GIPA regulates the use of genetic testing information in both the medical and commercial settings. Our focus is on Section 30 of the Act, which provides that no person or company "may disclose or be compelled to disclose the identity of any person upon whom a genetic test is performed or the results of a genetic test in a manner that permits identification of the subject of the test." 410 ILCS 513/30(a). Section 40, in turn, provides "[a]ny person aggrieved by a violation of this Act shall have a right of action" in an Illinois court. Id. at 513/40.
In July 2021, Bridges and Cunningham filed a putative class action in Illinois state court alleging that Blackstone had violated Section 30. Both plaintiffs had purchased DNA testing products from Ancestry and submitted saliva samples for genetic sequencing years earlier. In December 2020, Blackstone purchased Ancestry in a "control acquisition"—commonly understood as an all-stock transaction. Because Ancestry had allegedly paired the plaintiffs' genetic tests with personally identifiable information—including names, emails, and home addresses—Bridges and Cunningham maintained that Blackstone, as part of acquiring Ancestry, had compelled the disclosure of their genetic identities in violation of Section 30.
Blackstone invoked the Class Action Fairness Act and removed the case to federal court. See 28 U.S.C. § 1332(d). The district court then granted Blackstone's motion to dismiss for failure to state a claim. The district court concluded that the complaint, by focusing exclusively on Blackstone's acquisition of Ancestry, did not adequately allege any compulsory disclosure, as required by Section 30 of GIPA. The district court further reasoned that even if a disclosure occurred and was compulsory, the complaint failed to allege that the genetic information could permit identification of the plaintiffs because the protected data was reportedly anonymized.
Having declined to amend their complaint, Bridges and Cunningham now appeal.
II
We review the district court's dismissal of the plaintiffs' complaint against a clean slate, accepting all well-pleaded facts as true and crediting all plausible inferences in the plaintiffs' favor. See Gociman v. Loyola Univ. of Chicago, 41 F.4th 873, 881 (7th Cir. 2022).
At the outset, the parties disagree over whether GIPA liability can attach to a company like Blackstone that allegedly receives protected information, rather than discloses that information. The disagreement arises from Section 30's "disclose or be compelled to disclose" language, with Blackstone contending that a recipient of protected information cannot be held liable even when it compels disclosure. The plaintiffs, of course, urge the opposite conclusion. The dearth of Illinois precedent examining GIPA makes this inquiry all the more challenging, but we need not decide this issue today, as the plaintiffs have failed to state a claim regardless.
The plaintiffs' theory of liability is limited and straightforward: Blackstone compelled the disclosure of protected genetic information through the act of acquiring Ancestry. Like the district court, however, we cannot plausibly infer that a run-of-the-mill corporate acquisition, without more alleged about that transaction, results in a compulsory disclosure within the meaning of Section 30. The fact that the acquisition took the form of an all-stock purchase further cuts against the plaintiffs' theory of liability. All we can say with certainty about Blackstone's all-stock acquisition of Ancestry is that a change in ownership occurred—nothing more. Put simply, we cannot infer from an acquisition alone—at least one structured as a stock transaction—that Blackstone compelled Ancestry to disclose genetic information. That inference requires more well-pleaded facts.
The plaintiffs' complaint was bare bones. All that the complaint alleged is that Blackstone, with its deep pockets, purchased Ancestry in a deal worth $4.7 billion. The plaintiffs focus on Blackstone's wealth and invite us to infer that the firm somehow forced or pressured Ancestry to disclose protected information by virtue of its market power. But that inference is far too attenuated for us to credit based on the few facts alleged in the complaint. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ("Factual allegations must be enough to raise a right to relief above the speculative level."). We have a hard time seeing Blackstone's alleged financial wherewithal—without more—as supporting an inference that the firm violated Section 30 of GIPA. These allegations alone do not suffice to state a claim.
Nor does it matter that Blackstone may have pursued the deal, at least in part, to obtain Ancestry's genetic information. True, the plaintiffs' complaint identified a Bloomberg news article reporting that Blackstone, as part of the firm's broader investment strategy, planned to sell data from unnamed portfolio companies to unaffiliated third parties. And the plaintiffs' complaint also fairly pointed to Ancestry's old privacy policy to support the allegation that the company would share data in the event of an acquisition. But that does not salvage the pleading's deficiency. The complaint still lacks a plausible allegation that Blackstone compelled Ancestry to disclose protected information. The plaintiffs did not allege, for example, that any term of the deal mandated prohibited disclosure. Without more, the plaintiffs have failed to state a claim under GIPA Section 30.
Finally, we disagree with the plaintiffs on the relevance of Section 5 as it relates to what constitutes compelling disclosure within the meaning of Section 30. In setting forth its intent in passing GIPA, the Illinois General Assembly explained that the Act would "limit[ ] the use or disclosure of, and requests for, protected health information to the minimum necessary." 410 ILCS 513/5(5). The plaintiffs maintain that the "requests for" language should inform how we interpret the "be compelled" language in Section 30. The upshot of this interpretation, in their view, would sweep the acquisition into Section 30's ambit without requiring more specific allegations. But this introductory provision on legislative intent does not graft new language into Section 30. The triggering language in Section 30 is "disclose or be compelled to disclose," which makes good sense—the provision is entitled "Disclosure of person tested and test results." Furthermore, other provisions in GIPA expressly contemplate "requests" and thereby give meaning to the "requests for" language in Section 5. See, e.g., id. at 513/25(c)(1) (prohibiting an employer from "request[ing] . . . genetic testing or genetic information . . . as a condition of employment"); id. at 513/25(f)-(i) (listing circumstances where requests are permitted).
At bottom, like the district court, we cannot plausibly infer from the plaintiffs' sparse allegations that Blackstone compelled disclosure of protected genetic information simply by acquiring Ancestry. And remember, too, that the plaintiffs chose not to amend their pleading despite learning of its deficiencies. Their complaint failed to state a claim under GIPA Section 30. For these reasons, we AFFIRM.