Melvin v. Big Data Arts LLC

• Court: District Court, N.D. Illinois
• Decided: August 3, 2023
• Docket: 1:21-cv-02194
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

David Melvin, on behalf of ) himself and all other ) similarly situated ) ) Plaintiff, ) ) v. ) No. 21 CV 2194 ) Sequencing, LLC, a California ) limited liability company ) ) Defendant. ) )

Memorandum Opinion and Order Plaintiff David Melvin alleges on behalf of himself and a class that defendant Sequencing LLC,1 which purports to offer “the world’s largest collection of DNA analysis reports,” violates the Illinois Genetic Information Privacy Act, 410 ILCS 513, et seq. (“GIPA”) by disclosing its customers’ genetic information to unknown third-party developers without first obtaining those customers’ consent. Before me is plaintiff’s motion for class certification, which seeks to certify a class defined as:

1 Counsel for Defendant represents that Big Data Arts, LLC, operated the website at issue in this lawsuit, and that Big Data Arts, LLC, later converted to Sequencing, Inc., a Delaware Corporation. See ECF 58, at n.1. Nevertheless, both parties name “Sequencing, LLC, a California limited liability Company” as defendant in all of their recent filings. In any event, the parties previously represented their counsel “are cooperating to correct the name of defendant in this action,” and that any inconsistencies in the defendant’s name do not affect the proceedings. ECF 20. All people located in the State of Illinois who, from January 28, 2020, through September 1, 2022, had their genetic test results disclosed to any third party by Sequencing.

Plaintiff also proposes a subclass of class members who purchased a DNA analysis through the Sequencing website that was actually conducted by a third-party tester, “Silverberry Genomix.” For the reasons that follow, I grant the motion. I. The Illinois legislature enacted the GIPA to enhance privacy protections prohibiting the unauthorized disclosure and use of an individual’s genetic information. See 410 ILCS 513/5 (expressing legislative intent). Plaintiff highlights three provisions of the statute that are relevant to his claim. First, Section 15 provides that “genetic testing and information derived from genetic testing is confidential and privileged and may be released only to the individual tested and to persons specifically authorized, in writing in accordance with Section 30, by that individual to receive the information[.]” 410 ILCS 513/15(a). Second, Section 30 provides that “[n]o person may disclose … the identity of any person upon whom a genetic test is performed or the results of a genetic test in a manner that permits identification of the subject of the test, except to … [a]ny person designated in a specific written legally effective authorization for release of the test results executed by the subject of the test…” 410 ILCS 513/30(a)(2). And third, Section 35 prohibits the dissemination of genetic information to an entity other than the one to which the subject provided it, stating that “[n]o person to whom the results of a test have been disclosed may disclose the test results to another person except as authorized under this Act.” 410 ILCS 513/35. Persons “aggrieved by a violation of this Act” are authorized to bring an action to recover statutory or actual damages, whichever is greater, and for injunctive relief. 410 ILCS 513/40(a). The gravamen of plaintiff’s complaint is that Sequencing offers genetic reports through an “online marketplace,” and that to produce these reports, it shares genetic information that its customers

upload to Sequencing’s website with third-party developers, allegedly without the customers’ consent. Plaintiff offers evidence garnered in discovery to establish that Sequencing’s liability under the GIPA is amenable to classwide adjudication. In particular, plaintiff relies on the testimony of Sequencing’s Chief Executive Officer and Fed. R. Civ. P. 30(b)(6) witness, Brandon Colby, to describe how Sequencing gathers genetic information from its customers and shares that information with third-party developers to produce many of the genetic reports available for purchase on Sequencing’s website. According to Mr. Colby, after a user creates an account with

Sequencing, he or she can either purchase a DNA test kit directly from Sequencing and return the results of the test or upload to Sequencing’s website the results of a DNA test taken or stored elsewhere—for example, from 23andMe or Ancestry.com. Colby Dep., ECF 53-1 at 31:15–37:1. Either option results in the creation of a “DNA data file” containing “raw human DNA data” that can be used to assess genotype and to analyze different aspects of the user’s genetic code. The user can then purchase from Sequencing’s “marketplace” reports based on these analyses that assess the user’s heart health, likely reactions to medications, or risks of developing inherited diseases, for example, or that provide personalized recommendations on diet or general health improvements, based on the user’s DNA. See Mot., ECF 53 at 5 (reproducing screenshot of Sequencing’s website showing

available reports). Most of the reports available on the marketplace are provided by third-party developers. Colby Dep., ECF 53-1 at 44:14–45:5 (estimating that 80% of the marketplace applications are developed by third parties). These developers access the DNA data they need to perform their analyses via an “application program interface” (or “App Market API”) that functions as a data pipeline between Sequencing and the third-party tester. See id. at 45:19–47:4; 48:3– 49:16. When a Sequencing customer purchases a report by clicking the “buy” link on Sequencing’s website, see ECF 53 at 5 (depicting page to purchase the “Basic Wellness” report run by Silverberry Genomix),

the customer’s genetic information is transmitted, along with other personal information, to the third-party application via the App Market API so that the requested analysis can be performed. Colby Dep. ECF 53-1 at 52:7-7. In some instances, a user may be directed to the third-party’s website to obtain the results of a DNA analysis, but this occurs, if at all, only after the user has purchased a report and his or her genetic information has been shared. See id. at 55:6-18. In his complaint, plaintiff alleges that he created an account with Sequencing in early 2020, then uploaded his genetic information to Sequencing’s website and purchased several genetic reports from Sequencing. Compl., ECF 1-1 at ¶¶ 24-25. Plaintiff later learned that his sensitive genetic and other identifying information were

sent to third party developers, including Silverberry Genomix. See id. at ¶ 25.2 Plaintiff claims that Sequencing did not inform him that his genetic information would be shared and that he never consented to the disclosure of that information to anyone. Id. at ¶¶ 27-28. According to plaintiff, Sequencing has provided only one screenshot containing language purporting to warn users that their data will be sent to third-party testers outside of Sequencing.com. Mot., ECF 53 at 6 (depicting screenshot). The putative warning is found in the “Instructions” tab of one analysis provided by Silverberry Genomix. Id.

2 The complaint itself does not identify the third-party developers to which plaintiff’s genetic information was disclosed, but Exhibit 2B to the Declaration of Michael Ovca appears to show that plaintiff ordered a “Basic Wellness” report from Silverberry Genomix, ECF 53- 2 at 64. II. “A plaintiff seeking class certification bears the burden of proving that her proposed class meets the four requirements of Federal Rule of Civil Procedure 23(a), as well as those for one of the three types of classes identified in Rule 23(b).” Dancel v. Groupon, Inc., 949 F.3d 999, 1004 (7th Cir. 2019). Because plaintiff is pursuing money damages on behalf of the proposed class and subclass, he seeks certification under Rule 23(b)(3). See Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 350, 362 (2011). Accordingly, he

must establish: “(1) that the questions of law or fact common to the members of the proposed class predominate over questions affecting only individual class members; and (2) that a class action is superior to other available methods of resolving the controversy. Messner v. Northshore University HealthSystem, 669 F.3d 802, 811 (7th Cir. 2012). Numerosity There is no genuine dispute that the proposed class satisfies Rule 23(a)(1), which requires that the class be “so numerous that joinder of all members is impracticable.” Fed. R. Civ. P. 23(a)(1). “While there is no magic number that applies to every case, a forty-

member class is often regarded as sufficient to meet the numerosity requirement.” Mulvania v. Sheriff of Rock Island Cnty., 850 F.3d 849, 859 (7th Cir. 2017). Here, Defendant’s CEO confirmed that at the time this lawsuit was filed, Sequencing had registered 1,550 users with an IP address in Illinois, and that of those, 869 users had uploaded and stored one or more data files on Defendant’s website. Ovca Decl., ECF 53-2 at ¶ 5. These numbers are more than adequate to satisfy numerosity. Commonality To satisfy the commonality requirement of Rule 23(a)(2), “[T]he class claims ‘must depend on a common contention’ that is ‘capable of classwide resolution—which means that determination of its truth or falsity will resolve an issue that is central to the validity of

each one of the claims in one stroke.’” Howard v. Cook Cnty. Sheriff’s Off., 989 F.3d 587, 598 (7th Cir. 2021) (quoting Dukes, 564 U.S. at 350) (alteration in Howard). Where a plaintiff alleges that a “standardized pattern of conduct” caused a similar injury to all member of a proposed class, commonality is generally satisfied. See Suchanek v. Sturm Foods, Inc., 764 F.3d 750 (7th Cir. 2014) (“[w]here the same conduct or practice by the same defendant gives rise to the same kind of claims from all class members, there is a common question.”). Plaintiff identifies six common questions that will have to be answered to establish defendant’s liability under the asserted provisions of GIPA: 1) “Did Sequencing have Class

members’ genetic testing results?”; 2) “Has a disclosure of genetic information occurred?”; 3) “Did the disclosure allow for third parties to identify the test subject?”; 4) “Did sequencing obtain the required written authorization to disclose test results?”; 5) “Was any disclosure of genetic information otherwise permitted by the GIPA?”; and 6) “What damages are Class members entitled to?” Mot., ECF 53 at 12-14. Plaintiff argues persuasively that common evidence, “namely, the preprogrammed workflow of Sequencing’s website, which operates the same way for both its users and third- party testers,” will answer each of these questions. Id., at 12. Sequencing articulates no argument to the contrary. Accordingly, I conclude that the commonality requirement is satisfied. Typicality

A class representative’s claims must by typical of those of the potential class members. Fed. R. Civ. P. 23(a)(3). A “plaintiff’s claim is typical if it arises from the same event or practice or course of conduct that gives rise to the claims of other class members and his or her claims are based on the same legal theory.” Keele v. Wexler, 149 F.3d 589, 595 (7th Cir. 1998). Here, Sequencing’s 30(b)(6) witness acknowledged that plaintiff’s experience interacting with Sequencing’s website was materially identical to that of other class members. Colby Dep., ECF 53-1 at 100:11-14. Not only does Sequencing fail to identify any contrary evidence, but its opposition brief omits any discussion of Rule

23(a)’s typicality requirement. This requirement, too, is satisfied. Adequacy of Representation This element of Rule 23(a) ensures that the class representative(s) “will fairly and adequately protect the interests of the class.” Stampley v. Altom Transp., Inc., 958 F.3d 580, 585 (7th Cir. 2020) (citation omitted). In assessing this factor, courts consider both “the adequacy of the named plaintiffs as representatives of the proposed class’s myriad members, with their differing and separate interests,” and “the adequacy of the proposed class counsel.” Gomez v. St. Vincent Health, Inc., 649 F.3d 583, 592 (7th Cir. 2011). Defendant does not challenge class counsel’s adequacy, see Opp., ECF 56 at 2 (defendant “does not take issue with counsel for Plaintiff”), and indeed, the record amply demonstrates

class counsel’s competence. See Ovca Decl., ECF 53-2 at Exh. 2-A. Defendant suggests that plaintiff is not an adequate class representative because “it appears unlikely that Plaintiff has suffered any damages at all,” id. at 13, but this bald statement— unaccompanied by authority or reasoned argument—is unpersuasive. Indeed, defendant offers no basis to believe that plaintiff would not be entitled to the same statutory damages he claims on behalf of the class and subclass if he succeeds in establishing defendant’s liability. I therefore conclude that plaintiff has satisfied Rule 23(a)(4). Predominance and Superiority

“Predominance is akin to commonality, but it imposes more stringent requirements.” Rogers v. BNSF Ry. Co., No. 19 C 3083, 2022 WL 854348, at *3 (N.D. Ill. Mar. 22, 2022) (Kennelly, J.) (citing Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 623–24 (1997)). The superiority requirement, meanwhile, “limits class certification to cases where the class action device ‘is superior to other available methods for fairly and efficiently adjudicating the controversy.’” Id. (quoting Fed. R. Civ. P. 23(b)(3)). Together, these requirements are intended “to cover cases in which a class action would achieve economies of time, effort, and expense, and promote uniformity of decision as to persons similarly situated, without sacrificing procedural fairness or bringing about other undesirable results.” Birchmeier v. Caribbean Cruise Line, Inc., 302 F.R.D. 240, 255 (N.D.

Ill. 2014) (quoting Amchem Prods., 521 U.S. at 615) (internal quotation marks and alterations omitted). In this case, it appears that no absent class members have filed individual GIPA claims against defendant, see Colby Dep., ECF 53-1 at 74:5-8, which is unsurprising given the low value of individual statutory damages claims as compared to the cost of litigation. Moreover, defendant has articulated to reason to believe that individual class members have an interest in pursuing and controlling separate GIPA actions against Sequencing. Indeed, it seems plain that a class action is the superior vehicle for pursuing the claims asserted here.

For the reasons above, I conclude that the class and subclass plaintiff proposes satisfy the requirements of Rules 23(a) and 23(b)(3). Defendant argues that I should nevertheless delay certification so that I can “probe behind the pleadings before coming to rest on the certification question.” Opp., ECF 56 at 13 (quoting General Tel. Co. of Southwest v. Falcon, 457 U.S. 147, 160 (1982)). As noted above, however, plaintiff’s motion does not rest on the pleadings alone but on the ample evidence he has developed in discovery. Moreover, defendant offers no hint of the evidence it expects to uncover that would cut against class treatment of plaintiff’s claims. Til. For the foregoing reasons, plaintiff’s motion for class certification is granted. ENTER ORDER:

Lb @eudA~ Elaine E. Bucklo United States District Judge Dated: August 3, 2023