The Illinois’ Genetic Information Privacy Act (“GIPA”) has been Illinois law for over twenty years. Yet, only in the last year or two has there been an explosion of lawsuits being filed against companies in various industries, all alleging violations of the statute.

This activity has undoubtedly been spurred on by the success plaintiffs have had bringing cases under Illinois’ Biometric Information Privacy Act. Both lawsuits provide for huge statutory damages and fee-shifting for prevailing plaintiffs (and their counsel), making them very attractive for plaintiffs’ lawyers.

What is GIPA?

Passed in 1998, GIPA protects the genetic information and genetic testing results of individuals. It also prohibits discrimination by employers based on genetic information. Notably, genetic information is broadly defined as not only the results of genetic testing, but also the “manifestation or possible manifestation of a disease or disorder in a family member of an individual.” This broad definition sits at the cornerstone of these lawsuits being filed. The statute provides that companies may not share genetic information without the individual’s written consent, and companies cannot require genetic testing of applicants, or use genetic information to make personnel decisions.

Damages are $2,500 per violation, with the possibility of $15,000 for intentional or reckless violations.

Who is being sued?

Numerous industries are currently being targeted with GIPA claims under differing theories of liability; particularly, insurance companies, genetic testing companies and companies that have suffered a data breach.

Employers in all industries are facing GIPA claims alleging that they require applicants to provide genetic information as part of pre-employment health screenings and are using that information to make personnel decisions. Defendants include companies like United Airlines, and AbbVie. It may be that this is the area of litigation that gets most traction, but time will tell.

What employers can do to comply with GIPA?

Although the statute has many requirements, GIPA has several notable prohibitions for an employer’s disclosure, use and collection of genetic and genetic testing information that employers need to know to get on the road towards compliance.

First, GIPA prohibits employers from obtaining, requesting or requiring genetic information and testing as a condition of employment, including for promotional opportunities. This prohibition not only applies to applicants but extends to their family members as well. Employers can’t purchase the genetic and genetic testing information of an applicant or their family members either.

Second, GIPA also prohibits employers from making or basing employment decisions on an applicant’s or employee’s or their family members’ genetic and genetic testing information. Of course, employers can’t discriminate against applicants or employees based on them or their family members’ genetic and genetic testing information in violation of state or federal employment discrimination laws, particularly the Illinois Human Rights Act, Title VII of the Civil Rights Act of 1964, the Americans With Disabilities Act and the Family and Medical Leave Act to name a few. Employers also can’t retaliate against an applicant or employee that alleges a violation of GIPA.

Third, with respect to employment agreements, employers can’t require an applicant or employee to sign an agreement that offers them employment, money or some other benefit in exchange for taking a genetic test.

Lastly, employers who offer employee wellness programs can only use genetic information or genetic testing in furtherance of a workplace wellness program benefiting employees if:

1. health or genetic services are offered by the employer;
2. the employee provides written authorization in accordance with GIPA;
3. only the employee or family member if the family member is receiving genetic services and the licensed health care professional or licensed genetic counselor involved in providing such services receive individually identifiable information concerning the results of such services; and
4. any individually identifiable information is only available for purposes of such services and cannot be disclosed to the employer except in aggregate terms that do not disclose the identity of specific employees. An employer cannot not penalize an employee who does not disclose his or her genetic information or does not choose to participate in a program requiring disclosure of the employee's genetic information.

In light of GIPA’s strict requirements, employers must ensure they are not improperly obtaining or using an applicant’s or employee’s – or their family members’ – genetic and genetic testing information. Employers must also ensure that they notify employees and obtain their written authorization whenever they disclose, obtain or use an employee’s genetic or genetic testing information for authorized and permissible purposes.