Illinois’ Genetic Privacy Law Demands Careful Data Collection

The next frontier of privacy litigation may be the Illinois Genetic Information Privacy Act, which has been hit with a wave of class actions since 2023.

Companies that hire employees to perform manual labor or work in a potentially hazardous environment may be more susceptible to GIPA claims because they may directly, or indirectly through third-party medical providers, request information that plaintiffs contend constitutes genetic data—for example, by requiring physicals or health questionnaires and interviews.

However, as GIPA litigation continues to gain momentum, Illinois employers should take proactive steps to ensure adherence with the law.

GIPA regulates how employers can use people’s genetic data, including genetic information and testing. Broadly, the law prohibits employers and their agents from conditioning employment on genetic data, or from using genetic data in discriminatory ways.

It covers the same types of genetic data as the Health Insurance Portability and Accountability Act:

• An individual’s genetic tests
• Family members’ genetic tests
• Manifestations of diseases or disorders in an individual or their family
• Any use of genetic services that interpret genetic tests, or participation in clinical research, by the individual or their family Information about a fetus carried by an individual or family member, or about any embryo legally held by the individual or family member using assisted reproductive technology
• Any analysis of human DNA, RNA, chromosomes, proteins, or metabolites that can detect genotypes, mutations, or chromosomal changes

Among other things, GIPA prohibits employers from:

• Conditioning employment on obtaining genetic data from a person or their family member
• Changing terms, conditions, or privileges of employment or terminating employment due to an employee’s or their family member’s genetic data
• Retaliating against any person for alleging a GIPA violation
• Using genetic data for workplace wellness programs without an employee’s written authorization, or penalizing employees who do not participate in such programs

GIPA contains a private right of action that allows an aggrieved plaintiff to recover for each violation: liquidated damages of $2,500 or actual damages (whichever is greater) for negligent violations, liquidated damages of $15,000 or actual damages (whichever is greater) for intentional and/or reckless violations, and reasonable attorney’s fees and costs. Injunctive relief is also available.

There is no express statute of limitations in GIPA, but a five-year statute of limitations may apply.

GIPA’s requirements and enforcement mechanisms resemble the Illinois Biometric Information Privacy Act, which regulates biometric data. Both laws include similarly strict consent requirements and prohibitions on collection, use, disclosure, and retention of their respective regulated data.

BIPA also includes a private right of action, and well over 3,000 class actions have been filed under the measure, resulting in large settlements and at least one large judgment.

Courts have so far interpreted GIPA similarly to BIPA. For instance, GIPA’s right of recovery was held “substantially identical” to BIPA, and the court noted both statutes arose during the same legislative session, suggesting a legislative intent that similar frameworks apply to both.

Plaintiffs are also citing prior BIPA decisions to assert they aren’t required to allege or prove actual damages to state a GIPA claim. Last year’s plaintiff-friendly BIPA decisions—applying a five-year limitations period, and holding that a separate BIPA claim accrues each time an entity scans or transmits an individual’s biometric data—could soon also be applied to GIPA. This would effectively increase the number of potential violations—and therefore potential damages awards (and settlements).

The rising surge of GIPA class action lawsuits may foreshadow a trend like BIPA. Only a handful of GIPA cases were filed before 2023, and they typically focused on things like at-home DNA test kits. Since 2023, plaintiffs’ attention has turned to pre-employment physicals and inquiries about basic family medical history.

GIPA’s liquidated damages provisions are two- to three-times higher than BIPA’s, so plaintiffs’ class action filings are only likely to increase. While there are currently several pending motions to dismiss in GIPA cases (which raise myriad defenses), rulings have yet to be issued, and there is minimal case law to date ruling on the viability of such defenses.

To mitigate GIPA liability, employers should consider these steps:

• Carefully evaluate what information they collect or use (directly or through a third-party vendor) from employees and whether such information could constitute genetic data. Consider whether that information’s utility outweighs the administrative burdens and enforcement risk
• Work with counsel to review and update practices, policies, and procedures to ensure full GIPA compliance, including as to obtaining consent
• Consider any additional steps to further protect against potential company liability (e.g., disclaimers, review of contracts with third party-medical providers, indemnification provisions, and insurance coverage)
• Review other genetic privacy laws (state and federal) and ensure compliance, even though those laws do not currently include private rights of actions
• Stay informed about developments in case law and seek legal guidance as needed to ensure ongoing compliance with the changing legal landscape.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.

Author Information

Michael Bleicher is counsel at Perkins Coie in Washington, D.C.

Calvin Cohen and Sara Davey are counsel at Perkins Coie in Chicago.

Arthur Rooney, Debra Bernard, and Mylan Traylor contributed to this article.

Write for Us: Author Guidelines