NEW YORK – A class action lawsuit alleges that genetic testing company Ancestry violated the rights of customers under a state genetic privacy law, which forbids disclosure of their genetic information to unauthorized third parties without written consent.
The suit was filed late last week by an Illinois minor called A.K. through his legal guardian Kelsi Kingsley in the US District Court for the Southern District of Illinois. It alleges that "thousands if not millions" of individuals' genetic information, including the defendant's, was illegally disclosed to Blackstone, the multinational private equity company that acquired Ancestry last year for $4.7 billion.
The lawsuit specifically claims that Ancestry violated the plaintiffs' rights under the Illinois Genetic Information Privacy Act, or GIPA. Similar to the federal Genetic Information Nondiscrimination Act, or GINA, GIPA became law in Illinois in 2020. It provides that "persons, such as [the] defendant, may not release and/or disclose genetic testing and information derived from genetic testing to anyone other than the individual tested or to persons specifically authorized in writing."
According to the lawsuit, Ancestry.com's consumer genomics business "uses DNA collected from its customers' saliva to provide its customers with information about their heritage as well as genetically related health characteristics." This resulted in Ancestry.com collecting a "massive database of genetic information" that in part made it an attractive acquisition target for Blackstone.
Following the acquisition, the suit alleges, Ancestry disclosed on its website that customers' genetic information would be released and/or disclosed to Blackstone for its use. "However, defendant failed to identity any method by which plaintiff and the class could prevent such disclosure of their genetic information to Blackstone or any other party," the lawsuit states, resulting in the "unlawful disclosure of Plaintiff's and the Class' genetic information, and the sharing and/or release of such information to Blackstone and its affiliates, if not other third parties."
The suit further alleges that Blackstone acquired all of the accompanying information gathered by Ancestry.com, including personal information that could be used to identify individual plaintiffs, including first and last names, email addresses, and/or home addresses, including age and gender in some instances.
On behalf of himself and other participants in the suit, the plaintiff is seeking an injunction requiring Ancestry to comply with GIPA; an award of damages, including statutory damages of $15,000 for each willful and/or reckless violation of GIPA or actual damages, whichever greater; an award of statutory damages of $2,500 for each negligent violation of GIPA or actual damages, whichever greater; as well as costs and attorneys' fees.
In an emailed statement, an Ancestry spokesperson said that "Ancestry believes this suit is without merit and will vigorously defend against these baseless claims."
Earlier this year Ancestry announced that it would discontinue its next-generation sequencing-based consumer genomics offering and health service to focus nearly exclusively on family history and genetic genealogy.