Class action litigation has exploded in cases involving violations of Illinois’ Biometric Information Privacy Act (“BIPA”). Less known and litigated is Illinois’s Genetic Information Privacy Act (“GIPA”) – enacted in 1998. But recent trends may portend an increase in GIPA filings on the horizon.
The Illinois legislature enacted GIPA to enhance privacy protections prohibiting the unauthorized disclosure and use of Illinois residents’ genetic information. Specifically, GIPA prohibits disclosure of the identity of any person subjected to a genetic test (or the genetic results) without the individual’s written consent. GIPA also bars employers from soliciting, requesting, requiring or purchasing genetic testing or genetic information of a person or a family member of the person as a condition of employment. Persons “aggrieved” by a GIPA violation can sue to recover liquidated damages of $2,500 for each violation.
Illinois courts have increasingly looked to BIPA decisions as a guide for interpreting GIPA. This is not surprising considering their similarities. Both statutes protect individuals’ privacy rights and entitle plaintiffs to liquidated damages so long as they are “aggrieved.” GIPA requires entities to obtain a person’s express written consent prior to requesting, disclosing, using or storing their genetic information. GIPA also incentivizes class actions. And indeed, Illinois courts have started to grant motions for class certification in GIPA cases. See Melvin v. Sequencing, LLC, 344 F.R.D. 231 (N.D. Ill. Aug. 3, 2023). These developments represent troublesome trends for GIPA defendants and mirror the Illinois courts’ treatment of BIPA cases.
In short, GIPA and BIPA are statutory cousins. They present similar challenges to any entity that collects, uses, stores, solicits, or discloses individuals’ sensitive personal information. To the extent a company obtains or otherwise handles an individual’s genetic information or genetic testing results, GIPA compliance is imperative.
Practice Tips: GIPA’s definitions of “genetic information,” “genetic services” and “genetic test” have the same meaning ascribed to them under HIPAA, as specified in 45 C.F.R. 160.103. Also, defendants sued under GIPA should investigate whether the plaintiff’s claim is subject to dismissal on a motion to compel arbitration.
