Ancestry sued again
The Legal Genealogist is going to go out on a limb here and declare that it must officially be silly suit season.
Because a lawsuit just filed against Ancestry is really really really silly.
Just filed in federal court in southern Illinois, the lawsuit alleges that Illinois law doesn’t allow Ancestry to share a DNA tester’s personal information with anybody — including a company that acquires Ancestry itself.1
The case arises from the acquisition of Ancestry by a private equity firm, Blackstone, Inc., in December 2020.2 The plaintiff, a minor represented by his mother, wants to sue on behalf of all Illinois customers of Ancestry DNA claiming that an acquiring company can’t get information from an acquired company under a genetic privacy law enacted by Illinois.3
The claim essentially is that the kid tested, then Blackstone acquired Ancestry, and then “Following Blackstone’s acquisition of Ancestry, (Ancestry) disclosed on its website that … genetic information would be released and/or disclosed to Blackstone for its use.”4 For that after-the-fact disclosure, the allegation cites the Ancestry privacy statement “last accessed on 06/4/2021.”5 And, the complaint alleges, “Plaintiff would not have agreed to have his genetic material provided to Ancestry.com if he had known that Defendant would disclose his genetic information without his consent to third-parties other than his Guardian such as Blackstone.”6
So…
You remember all those times I’ve said we need to read the terms and conditions?
Remember all the times I’ve said we should never test, or ask a cousin to test, or allow another to test, without making sure to read the terms and conditions?
Let’s read those terms and conditions, shall we?
The very first Ancestry privacy statement I can find online is dated 14 December 2010, and it says: “As our business continues to grow, we might buy or sell subsidiaries or business units. In these transactions, customer information is often one of the transferred assets, remaining subject to promises made in existing privacy statements. Also, in the event that Ancestry, or substantially all of its assets are acquired, customer information will, as a matter of course, be one of the transferred assets.”7
Then there’s the one dated 29 August 2012: “Additionally, as our business continues to grow and change, we might restructure, buy, or sell subsidiaries or business units. In these transactions, customer information is often one of the transferred assets, remaining subject to promises made in then prevailing privacy statements. Also, in the event that Ancestry, or substantially all of its assets or stock are acquired, transferred, disposed of (in whole or part and including in connection with any bankruptcy or similar proceedings), personal information will as a matter of course be one of the transferred assets.”8
Or the one dated 14 October 2016: “Additionally, as our business continues to grow and change, we might restructure, buy, or sell subsidiaries or business units. In these transactions, customer information is often one of the transferred assets, remaining subject to promises made in then prevailing privacy statements, and, accordingly, we may transfer personal information in connection with such transactions. Also, in the event that Ancestry, or substantially all of its assets or stock are acquired, transferred, disposed of (in whole or part and including in connection with any bankruptcy or similar proceedings), personal information will as a matter of course be one of the transferred assets.”9
Or the one dated 30 April 2018: “If Ancestry or its businesses are acquired or transferred (including in connection with bankruptcy or similar proceedings), we will share your Personal Information with the acquiring or receiving entity. The promises in this Privacy Statement will continue to apply to your Personal Information that is transferred to the new entity.”10
Or the last one I can find before the Blackstone acquisition, dated 23 December 2019: “If Ancestry or its businesses are acquired or transferred (including in connection with bankruptcy or similar proceedings), we will share your Personal Information with the acquiring or receiving entity. The promises in this Privacy Statement will continue to apply to your Personal Information that is transferred to the new entity.”11
In other words, if plaintiff and his mama didn’t know that all of the assets of the acquired company could be purchased by an acquiring company — subject to the promises of privacy that have always been there — it’s because they didn’t read the terms and conditions.
Seriously, this is silly.
I mean, I have my differences with Ancestry over a lot of things.
But clear and unambiguous disclosure about what might happen in an acquisition isn’t one of them. The acquiring company acquires everything the acquired company had — but the privacy constraints we signed up for continue to bind the acquiring company.
This is such a seriously silly case that I will be most surprised if the federal court doesn’t dispose of this in short order.
Cite/link to this post: Judy G. Russell, “Silly suit season,” The Legal Genealogist (https://www.legalgenealogist.com/blog : posted 3 Nov 2021).
SOURCES
- See Complaint, A.K. by Kingsley v. Ancestry.com DNA, No. 3:21-cv-01368-DWD, filed 29 Oct 2021, United States District Court for the Southern District of Illinois. ↩
- See Judy G. Russell, “Business as usual,” The Legal Genealogist, posted 7 Aug 2020 (https://www.legalgenealogist.com/blog : accessed 3 Nov 2021). ↩
- See Illinois Genetic Information Privacy Act, Illinois General Assembly (https://www.ilga.gov/default.asp : accessed 3 Nov 2021). ↩
- Ibid., paragraph 19. ↩
- Ibid., note 2. ↩
- Ibid., paragraph 29. ↩
- “Privacy Statement,” updated 14 Dec 2010, Ancestry.com, via Internet Archive Wayback Machine (https://archive.org/web/ : accessed 3 Nov 2021). ↩
- Ibid., “Ancestry.com Privacy Statement,” updated 29 August 2012. ↩
- Ibid., “Ancestry.com Privacy Statement,” updated 14 October 2016. ↩
- Ibid., “Your Privacy,” effective date 30 April 2018. ↩
- Ibid., “Your Privacy,” effective date 23 December 2019. ↩
Lawyer who filed this suit should be sanctioned. I do hope this gets tossed sooner.
There’s also the minor little issue of the part of the terms and conditions that says no class actions… This case should be short-lived, for sure.
Keep us posted. It may seem silly, but physicians are well aware of the Court and Madison Co., IL juries. I would not be surprised to see this go to trial and see a big monetary award. Illinois … my state … is a plaintiff nirvana. Madison Co is their favor landing pad.
Even if this case were to proceed it would NOT be a “Madison County” jury. This is federal court. There are 38 counties in the Southern District and 11 in this division.
Definitely a big mistake not to read all the “boring” details anytime you are providing information. Especially since Ancestry’s DNA database and all that “cause of death” data many people enter is now shared with Blackstone whose list of subsidiaries includes medical groups and other health care companies.
An even BIGGER mistake not to read the part that says the acquiring company only gets the data under the same privacy constraints as the acquired company. So, no, medical groups and health care companies are NOT getting our DNA data.