Is Illinois’ GIPA the Next BIPA?

Perhaps in response to recent success pursuing claims under Illinois’ Biometric Information Privacy Act (BIPA), the plaintiffs’ bar is now also pursuing class actions against employers under another unique Illinois privacy law that provides a private right of action and statutory damages—Illinois’ Genetic Information Privacy Act (GIPA).

Generally, GIPA regulates employers’ collection and use of genetic information from employees and candidates and prohibits collecting or using this information in a discriminatory manner. Critically, GIPA provides a private right of action to any person aggrieved by a violation and provides for potentially significant statutory penalties.

As a result, Illinois employers must take appropriate steps to ensure compliance with GIPA if they: 1) request, collect or disclose genetic information—such as employee and/or family medical histories, or 2) conduct genetic testing.

Employer Requirements and Prohibitions Under GIPA

GIPA defines “genetic information” as information about genetic tests, manifestation of a disease or disorder, or genetic services. 

GIPA prohibits employers from: 1) soliciting, requesting, requiring, or purchasing genetic information or testing of a person or a family member of the person as a condition of employment or pre-employment application; 2) “affecting” the terms and conditions of employment of any person because of genetic information or testing; or 3) retaliating against employees who allege violations. 

In the context of workplace wellness programs, GIPA also restricts employers from using genetic information or testing unless certain circumstances are met, i.e., employers obtain written authorization and do not receive any individually identifiable information relating to employees.

Under GIPA, employers are required to maintain and secure genetic information in a manner consistent with federal law and may only disclose genetic information under limited circumstances (i.e., to designated persons with consent of the individual or authorized agents/employees of a health care provider). 

Critically, if GIPA is violated, a prevailing party may recover potentially significant relief—including statutory penalties of $2,500 for each negligent violation and $15,000 for each intentional or reckless violation (or actual damages, whichever is greater), as well as injunctive relief and attorney fees and costs. 

The Rise of GIPA Class Actions Against Employers

Despite being enacted in 1998, GIPA only recently became a source of litigation activity.

Specifically, the plaintiffs’ bar has filed a considerable number of class action lawsuits against employers for alleged violations of GIPA, likely due to GIPA’s provision of potentially significant statutory penalties and attorney fees.

The recent wave of class action complaints typically allege that an employer requested or required candidates or employees to disclose family medical histories (such as a history of a specific disease or disorder) or submit to pre-employment physical examinations as either a condition of employment or as part of the hiring process. According to the complaints, employers allegedly requested this information in an effort to attempt to avoid risk and liability for workplace injuries caused by genetic conditions and/or to make decisions regarding particular job assignments.

Complaints have only recently begun to be filed under GIPA, and thus there have been few decisions interpreting GIPA in the employment context. However, due to its parallels with BIPA, GIPA may ultimately receive similarly broad interpretation by the courts. For example, like BIPA, GIPA provides a private right of action only to “any person aggrieved by a violation.” In Rosenbach v. Six Flags, the Illinois Supreme Court interpreted identical language in BIPA to mean that a plaintiff need not allege any actual injury or harm to be deemed “aggrieved.”  Rather, “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under [BIPA] in order to qualify as an ‘aggrieved person’ and be entitled to seek liquidated damages and injunctive relief.”

The Illinois Supreme Court’s ruling in Rosenbach opened the floodgates for BIPA class action litigation and permitted plaintiffs to pursue damages for technical violations of BIPA even in the absence of any actual injury. Time will tell if GIPA is interpreted in a similar manner, and if the plaintiffs’ bar is similarly incentivized to pursue GIPA claims.

Practical Steps for Employers

In light of the above, employers should determine whether they request, collect, use or disclose any information received from candidates or employees that might qualify as “genetic information” covered by GIPA.

Employers should also review the purposes for the collection and how the information is used. Specifically, employers should assess whether “genetic information” is requested and collected as a condition of employment, is used as part of the hiring process (for example, as part of an employment application) or is used in any manner impacting the employment relationship (for example, to determine job assignments).

Employers that collect and use genetic information as part of a workplace wellness program must comply with GIPA’s requirements—including obtaining written authorizations from candidates and employees and ensuring that no individually identifiable information is received.

Finally, employers should monitor case law developments surrounding GIPA. Those decisions may further clarify what constitutes “genetic information,” what specific employer actions may trigger liability and ultimately determine if GIPA will become the next BIPA.

Thomas E. Ahlering and Peter J. Wozniak are attorneys with King & Spalding in Chicago. © 2024 King & Spalding. All rights reserved. Reposted with permission.