Even if you’re familiar with Illinois’ Biometric Information Privacy Act (BIPA), you may not be familiar with its less (in)famous cousin, the Genetic Information Privacy Act (GIPA). But GIPA litigation presents an increasing risk to employers, insurers, unions, and other organizations that collect and use information about people’s medical histories. Recent GIPA decisions rely on similarities between BIPA and GIPA to broaden the scope of actionable conduct and make it harder for defendants to dismiss GIPA complaints. Accordingly, businesses should be proactive about how they are handling genetic information (including medical histories), similar to precautions they take about collecting and using biometric information.
GIPA broadly restricts how entities may use “genetic information” and borrows that term’s definition from the Health Insurance Portability and Accountability Act (HIPAA). In particular, GIPA protects genetic testing results, including any “manifestation of a disease or disorder in family members of [an] individual”—via requirements and language that closely track BIPA’s treatment of biometric data.
Like BIPA, GIPA includes a private right of action that permits any individual “aggrieved” by a violation to sue. “Aggrieved” plaintiffs may recover liquidated damages of $2,500 or actual damages (whichever is greater) for negligent violations and liquidated damages of $15,000 or actual damages for intentional or reckless violations—as well as attorneys’ fees and costs or injunctive relief. These liquidated damages provisions are two times to three times higher than their BIPA counterparts.
Although GIPA has been on the books since 1998, relatively few cases were filed in its first two decades. However, after increased BIPA litigation, including massive damages awards and multimillion– or billion– dollar settlements, over 50 new GIPA complaints have been filed since 2023. Those cases recently yielded two decisions in the U.S. District Court for the Northern District of Illinois that rely on BIPA precedent to reach expansive, plaintiff-friendly interpretations of GIPA.
First, in Taylor v. Union Pacific R.R. Co., the Court relied on GIPA’s and BIPA’s similar language and intent to find lenient standing requirements for GIPA plaintiffs. Specifically, the Court held that BIPA’s expansive definition of “aggrieved persons,” which according to the Illinois Supreme Court encompasses individuals who sustained no “actual injury or adverse effect[] beyond violation of his or her rights under the statute,” also applies to GIPA. Likewise, the Court concluded, the plaintiffs had Article III standing because they suffered a “trespass” into the “private domain” of their genetic history—again analogizing to BIPA precedent on the issue.
Second, in McKnight v. United Airlines, the Court held that (1) persons outside Illinois may bring GIPA suits if the underlying activity “occurred primarily substantially in Illinois” and (2) GIPA has a five-year statute of limitations. Again, both conclusions mirror the current state of play on BIPA’s extraterritorial application and statute of limitations.
Finally, both cases held that “genetic information” includes family medical history, based on HIPAA’s definition of that term. Accordingly, requests for information about family history of diseases with hereditary elements, such as cancer, diabetes, or heart disease, seek information that is potentially actionable under GIPA.
These decisions likely open the door to more GIPA litigation and will make it harder to defeat complaints at the motion to dismiss stage. Businesses that solicit and use information about individual or family medical history should invest in careful review and revisions to their practices and disclosures in connection with the law’s requirements.
