Overview
Litigation 
under the Illinois Biometric Information Privacy Act has recently been making all the headlines, but did you know that Illinois statutes contain protection for genetic information also?
Illinois’ lesser-known privacy statute, the Genetic Information Privacy Act (GIPA), was enacted in 1998, and meant to protect information about an individual’s genetic material, which is broadly defined in the statute as not only the results of genetic tests, but also the genetic tests of family members, and the “manifestation or possible manifestation of a disease or disorder in a family member of the individual.”
GIPA contains numerous provisions concerning the disclosure and use of an individual’s genetic information. Some of the more prominent restrictions are as follows:
- Genetic testing, and information derived from it, may only be released to the individual tested and persons authorized in writing by the individual tested;
- Insurers may not use information derived from genetic testing for non-therapeutic purposes (i.e., determinations of eligibility, computation of premiums, or pre-existing condition exclusions);
- Employers may not require genetic testing as a condition of employment, and may not use the results of genetic testing to affect the terms of employment, or use such information in furtherance of a workplace wellness program; and
- No person may be compelled to disclose the identity of any person upon whom a genetic test is performed or the results of a genetic test that would identify the subject of the test.
Like the Biometric Information Privacy Act, GIPA provides for draconian statutory damages of $2,500 per negligent violation, or actual damages, whichever are greater. And, intentional or reckless violations of the statute result in damages of $15,000 per violation.
GIPA lawsuits, no doubt spurred by these staggering damages provisions, have been brought against several entities, including Ancestry.com and Ford Motor Company. Ancestry.com is accused of sharing genetic information without individuals’ written consent when Blackstone acquired it in 2020. And the lawsuit against Ford accuses the auto manufacturer of improperly asking job applicants about their family medical histories, which the plaintiff alleges implicates genetic information as defined in the statute. Both cases are currently pending.
If your company is doing business in Illinois, GIPA should definitely be on your radar. Ask yourself the following questions to determine whether additional steps must be taken to ensure compliance with the statute:
- In the course of your business, do you collect the genetic information, or medical histories of your customers, employees, or their family members?
- Does your company require “health screenings” as part of your application process, or as part of any employee health or wellness program?
- If you offer health insurance to individuals, do you collect genetic information, and if so, who do you disclose it to, and how do you use that information?
With its large damages provisions and broad definition of “genetic information,” GIPA lawsuits have the real potential to be the next wave of class action lawsuits flooding Illinois’ dockets. Make sure that your company is compliant.
