Carolyn Bridges v. Blackstone, Inc.

In the

United States Court of Appeals For the Seventh Circuit ____________________ No. 22-2486 CAROLYN BRIDGES and RAYMOND CUNNINGHAM, Plaintiffs-Appellants, v.

BLACKSTONE, INC., Defendant-Appellee. ____________________

Appeal from the United States District Court for the Southern District of Illinois. No. 3:21-cv-1091 — David W. Dugan, Judge. ____________________

ARGUED MARCH 27, 2023 — DECIDED MAY 1, 2023 ____________________

Before HAMILTON, SCUDDER, and PRYOR, Circuit Judges. SCUDDER, Circuit Judge. Carolyn Bridges and Raymond Cunningham provided their DNA to Ancestry.com, the larg- est genealogy company in the world. A few years later, Black- stone, Inc. acquired Ancestry in a deal reportedly worth $4.7 billion. Bridges and Cunningham filed this putative class action against Blackstone, alleging that the acquisition re- sulted in a violation of Illinois’s Genetic Information Privacy

2 No. 22-2486

Act. The district court concluded that Bridges and Cunning- ham failed to state a claim. We agree and affirm. I Many courts have developed great familiarity with Illi- nois’s privacy protection provisions in recent years. Most no- tably, the General Assembly enacted the Biometric Infor- mation Privacy Act in 2008, which has been the subject of many decisions in our court and made the acronym BIPA commonplace. Less known and litigated, however, is Illi- nois’s Genetic Information Privacy Act, which went into effect in 1998. Drawing on these two statutes’ privacy-centric simi- larities, the parties refer to this latter statute as GIPA. GIPA regulates the use of genetic testing information in both the medical and commercial settings. Our focus is on Section 30 of the Act, which provides that no person or com- pany “may disclose or be compelled to disclose the identity of any person upon whom a genetic test is performed or the re- sults of a genetic test in a manner that permits identification of the subject of the test.” 410 ILCS 513/30(a). Section 40, in turn, provides “[a]ny person aggrieved by a violation of this Act shall have a right of action” in an Illinois court. Id. at 513/40. In July 2021, Bridges and Cunningham filed a putative class action in Illinois state court alleging that Blackstone had violated Section 30. Both plaintiffs had purchased DNA test- ing products from Ancestry and submitted saliva samples for genetic sequencing years earlier. In December 2020, Black- stone purchased Ancestry in a “control acquisition”—com- monly understood as an all-stock transaction. Because Ances- try had allegedly paired the plaintiffs’ genetic tests with

No. 22-2486 3

personally identifiable information—including names, emails, and home addresses—Bridges and Cunningham maintained that Blackstone, as part of acquiring Ancestry, had compelled the disclosure of their genetic identities in vi- olation of Section 30. Blackstone invoked the Class Action Fairness Act and re- moved the case to federal court. See 28 U.S.C. § 1332(d). The district court then granted Blackstone’s motion to dismiss for failure to state a claim. The district court concluded that the complaint, by focusing exclusively on Blackstone’s acquisi- tion of Ancestry, did not adequately allege any compulsory disclosure, as required by Section 30 of GIPA. The district court further reasoned that even if a disclosure occurred and was compulsory, the complaint failed to allege that the ge- netic information could permit identification of the plaintiffs because the protected data was reportedly anonymized. Having declined to amend their complaint, Bridges and Cunningham now appeal. II We review the district court’s dismissal of the plaintiffs’ complaint against a clean slate, accepting all well-pleaded facts as true and crediting all plausible inferences in the plain- tiffs’ favor. See Gociman v. Loyola Univ. of Chicago, 41 F.4th 873, 881 (7th Cir. 2022). At the outset, the parties disagree over whether GIPA lia- bility can attach to a company like Blackstone that allegedly receives protected information, rather than discloses that in- formation. The disagreement arises from Section 30’s “dis- close or be compelled to disclose” language, with Blackstone contending that a recipient of protected information cannot

4 No. 22-2486

be held liable even when it compels disclosure. The plaintiffs, of course, urge the opposite conclusion. The dearth of Illinois precedent examining GIPA makes this inquiry all the more challenging, but we need not decide this issue today, as the plaintiffs have failed to state a claim regardless. The plaintiffs’ theory of liability is limited and straightfor- ward: Blackstone compelled the disclosure of protected ge- netic information through the act of acquiring Ancestry. Like the district court, however, we cannot plausibly infer that a run-of-the-mill corporate acquisition, without more alleged about that transaction, results in a compulsory disclosure within the meaning of Section 30. The fact that the acquisition took the form of an all-stock purchase further cuts against the plaintiffs’ theory of liability. All we can say with certainty about Blackstone’s all-stock acquisition of Ancestry is that a change in ownership occurred—nothing more. Put simply, we cannot infer from an acquisition alone—at least one struc- tured as a stock transaction—that Blackstone compelled An- cestry to disclose genetic information. That inference requires more well-pleaded facts. The plaintiffs’ complaint was bare bones. All that the com- plaint alleged is that Blackstone, with its deep pockets, pur- chased Ancestry in a deal worth $4.7 billion. The plaintiffs fo- cus on Blackstone’s wealth and invite us to infer that the firm somehow forced or pressured Ancestry to disclose protected information by virtue of its market power. But that inference is far too attenuated for us to credit based on the few facts alleged in the complaint. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (“Factual allegations must be enough to raise a right to relief above the speculative level.”). We have a hard time seeing Blackstone’s alleged financial

No. 22-2486 5

wherewithal—without more—as supporting an inference that the firm violated Section 30 of GIPA. These allegations alone do not suffice to state a claim. Nor does it matter that Blackstone may have pursued the deal, at least in part, to obtain Ancestry’s genetic information. True, the plaintiffs’ complaint identified a Bloomberg news article reporting that Blackstone, as part of the firm’s broader investment strategy, planned to sell data from unnamed port- folio companies to unaffiliated third parties. And the plain- tiffs’ complaint also fairly pointed to Ancestry’s old privacy policy to support the allegation that the company would share data in the event of an acquisition. But that does not sal- vage the pleading’s deficiency. The complaint still lacks a plausible allegation that Blackstone compelled Ancestry to dis- close protected information. The plaintiffs did not allege, for example, that any term of the deal mandated prohibited dis- closure. Without more, the plaintiffs have failed to state a claim under GIPA Section 30. Finally, we disagree with the plaintiffs on the relevance of Section 5 as it relates to what constitutes compelling disclo- sure within the meaning of Section 30. In setting forth its in- tent in passing GIPA, the Illinois General Assembly explained that the Act would “limit[ ] the use or disclosure of, and re- quests for, protected health information to the minimum nec- essary.” 410 ILCS 513/5(5). The plaintiffs maintain that the “requests for” language should inform how we interpret the “be compelled” language in Section 30. The upshot of this in- terpretation, in their view, would sweep the acquisition into Section 30’s ambit without requiring more specific allega- tions. But this introductory provision on legislative intent does not graft new language into Section 30. The triggering

6 No. 22-2486

language in Section 30 is “disclose or be compelled to dis- close,” which makes good sense—the provision is entitled “Disclosure of person tested and test results.” Furthermore, other provisions in GIPA expressly contemplate “requests” and thereby give meaning to the “requests for” language in Section 5. See, e.g., id. at 513/25(c)(1) (prohibiting an employer from “request[ing] … genetic testing or genetic information … as a condition of employment”); id. at 513/25(f)–(i) (listing circumstances where requests are permitted). At bottom, like the district court, we cannot plausibly infer from the plaintiffs’ sparse allegations that Blackstone com- pelled disclosure of protected genetic information simply by acquiring Ancestry. And remember, too, that the plaintiffs chose not to amend their pleading despite learning of its defi- ciencies. Their complaint failed to state a claim under GIPA Section 30. For these reasons, we AFFIRM.