Over the last several years, more than a thousand class action lawsuits have been filed alleging violations of the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (BIPA). This law has been seen as an easy mark for the plaintiffs’ bar, in part because of the potential for recovering liquidated damages even absent an actual “injury.” Hundreds of millions of dollars have been paid out in settlements to resolve these BIPA class actions, many of which are brought by current and former Illinois employees.

Is there another similar trend on the horizon? Potentially yes, from the Illinois Genetic Information Privacy Act (GIPA).

Like BIPA, GIPA imposes requirements on the use of private information and imposes steep financial penalties for non-compliance. At least one court has construed GIPA similarly to BIPA as not requiring a plaintiff allege an actual injury to recover damages.[i] Consequently, over the last several months, dozens of class actions have been filed against employers alleging violations of GIPA – portending perhaps the next wave of information privacy class actions in Illinois.

What Is GIPA?

GIPA was enacted in 1998 with the intent of “facilitating voluntary and confidential nondiscriminatory use of genetic testing information.” 410 ILCS 513/5(3). The statute was amended in 2008, the same year the federal Genetic Information Nondiscrimination Act was enacted.

Broadly speaking, GIPA regulates the use of genetic information and genetic testing in the employment, commercial, and medical settings. It imposes restrictions on the use and disclosure of certain information, and, in addition to addressing confidentiality concerns, it seeks to prevent discrimination based on genetic testing and information.

What Does GIPA Require of Employers?

Section 25 of GIPA governs the “[u]se of genetic testing information by employers.”

Under this Section, GIPA prohibits employers from “directly or indirectly” soliciting, requesting, requiring, or purchasing “genetic testing” or “genetic information” from an individual or that individual’s family member as a condition of employment or application for employment. 410 ILCS 513/25(c)(1). The term “genetic information,” in turn, is defined (by reference to the Health Insurance Portability and Accountability Act of 1996) to include (among other items) the “manifestation of a disease or disorder in family members[.]” 45 CFR § 160.103.

Accordingly, plaintiffs in GIPA class actions have alleged that physical examinations during which employees or applicants are asked for information about their family medical history, as a condition of employment, run afoul of GIPA. The premise is that soliciting such information for employment or preemployment purposes is an impermissible use of genetic testing information by employers and thus violates GIPA.

Further, GIPA prohibits employers from discriminating or taking adverse employment actions because of genetic testing or genetic information. 410 ILCS 513/25(c)(2)-(3). GIPA also requires that employers treat genetic testing and genetic information in a manner consistent with the requirements of federal law. 410 ILCS 513/25(a). There are other requirements and potential exclusions surrounding an employer’s use of genetic testing and genetic information, such as (for example) in connection with a workplace wellness program. 410 ILCS 513/25(e). GIPA also has an anti-retaliation provision. 410 ILCS 513/25(c)(4).

What Are the Consequences of Violating GIPA?

Here is why GIPA has become a recent target in class action litigation.

GIPA provides that a person “aggrieved” by a violation of this law may bring an action in court and recover “for each violation” the following: (a) $2,500 for a negligent violation (or actual damages if greater), and (b) $15,000 for an intentional or reckless violation (or actual damages if greater). 410 ILCS 513/40(a)(1)-(2). And GIPA, like BIPA, has been construed as not requiring an actual injury to recover these damages. As a result, exposure under GIPA could be substantial.

In addition to monetary damages – and also like BIPA – a prevailing plaintiff may recover reasonable attorney’s fees and costs and an injunction against the offending party. 410 ILCS 513/40(a)(3)-(4).

What’s Next?

It remains to be seen whether GIPA class action litigation will follow in the same prolific course as BIPA. A body of caselaw has yet to emerge. And time will tell whether courts will construe GIPA in the same largely plaintiff- and employee-friendly manner as they have generally construed BIPA.

At this point, companies with Illinois employees should evaluate whether they are asking employees or applicants about their families’ medical histories or otherwise using genetic information. If so, they should consider evaluating and seeking guidance about potentially discontinuing this practice or pursuing options for mitigating legal risk.

[i] See Bridges v. Blackstone Group, Inc., Case No. 21-cv-1091-DWD, 2022 WL 2643968 (S.D. Ill. July 8, 2022).

This Client Alert has been prepared by Tucker Ellis LLP for the use of our clients. Although prepared by professionals, it should not be used as a substitute for legal counseling in specific situations. Readers should not act upon the information contained herein without professional guidance.