Illinois employers are likely still reeling from the thousands of biometric privacy class action lawsuits that have flooded court dockets over the last 5 years. Another wave is coming—this time, under the Illinois Genetic Information Privacy Act (the “GIPA”). It is not only direct-to-consumer genetic testing companies that need to be concerned. There has been a significant uptick in class action filings against employers under this statute in recent months, though the GIPA has been in effect in some form since January 1998 and was amended as recently as January 2018. And the potential exposure under the GIPA is even more draconian than under the Illinois Biometric Information Privacy Act (“BIPA”).

The GIPA regulates the confidentiality of genetic information and the use of genetic testing information by employers or for insurance purposes or public health activities. Under the GIPA, an “employer” is “every other person [public or private corporation, partnership, association, or other legal entity] employing employees within the State [of Illinois].”

Here is what those employers need to know:

What is “genetic information”?

The GIPA adopts the meaning ascribed to this term under HIPAA. It means:

• An individual’s genetic tests
• The genetic tests of the individual’s family members
• The manifestation of a disease or disorder in the individual’s family members
• Any request for, or receipt of, genetic services, or participation in clinical research by the individual or the individual’s family members
• [Includes information of a fetus carried by the individual or a family member who is a pregnant woman and of any embryo legally held by the individual or family member utilizing assisted reproductive technology] 

“Genetic information” does not include information about the sex or age of any individual.

What is “genetic testing”?

The GIPA adopts the meaning ascribed to the term “genetic test” under HIPAA. It means:

• An analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes

“Genetic testing” or a “genetic test” does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition.

What does the GIPA require of an “employer”?

Treatment of genetic testing and genetic information in a manner consistent with federal law (including the Genetic Information Nondiscrimination Act of 2008, Americans with Disabilities Act, Title VII of the Civil Rights Act of 1064, the Family Medical Leave Act of 1993, and the Occupational Safety and Health Act of 1970)

What does the GIPA prohibit?

• Releasing genetic testing and genetic information derived from genetic testing without written consent (subject to certain exceptions)
• Soliciting, requesting, requiring, or purchasing genetic testing or genetic information of a person or their family members as a condition of employment, reemployment application, labor organization membership, or licensure
• Affecting the terms of employment, a preemployment application, labor organization membership, or licensure because of genetic testing or genetic information with respect to the person or their family member
• Terminating employment, labor organization membership, or licensure because of genetic testing or genetic information with respect to the employee or their family member
• Limiting, segregating, or classifying employees in any way that would deprive or tend to deprive any employee of employment opportunities or otherwise adversely affect the status of the employee as an employee because of genetic testing or genetic information with respect to the employee or their family member
• Retaliating against any person alleging a violation of the GIPA or participating in any manner in a proceeding under the GIPA
• Reaching an agreement with a person to take a genetic test in exchange for any pay or benefit
• Using genetic information or genetic testing in furtherance of a workplace wellness program benefitting employees (absent certain conditions)

What are potential consequences of non-compliance with the GIPA?

Reminiscent of similar language in the BIPA, any person “aggrieved” by a violation of the GIPA “shall have a right of action in a State circuit court or as a supplemental claim in a federal district court against an offending party.” For each violation of the GIPA, a prevailing party may potentially recover: liquidated statutory damages of $2,500 (for negligent violations) or $15,000 (for intentional or reckless violations), or actual damages, whichever is greater. Attorneys’ fees and costs, including expert witness fees and other litigation expenses, may also be recoverable. Injunctive relief is also available where warranted.

Given that GIPA lawsuits have been filed as class actions, exposure for companies in violation of the GIPA can potentially be significant.

[View source.]