Illinois Genetic Information Privacy Act (GIPA)

The Illinois Genetic Information Privacy Act (GIPA) is a state law designed to protect individuals’ genetic data and to prevent its misuse. Enacted in 2008, GIPA establishes rules and guidelines for the collection, use and disclosure of genetic information by employers, insurers and other organizations. 

With the increasing use of genetic testing and data, GIPA ensures that Illinois residents have strong protections to control their genetic information and privacy.

GIPA is one of the most comprehensive genetic data protection laws in the United States and has been a key factor in ensuring that genetic information is not used to discriminate or unfairly disadvantage individuals. The law has formed the foundation of numerous enforcement actions to ensure compliance, particularly in employment practices and the insurance industry.

Key Provisions of GIPA include:

• Informed Consent: Organizations must obtain explicit, written consent from individuals before collecting, using or sharing their genetic information. The consent must specify the purpose for which the data will be used and how long it will be stored.
• Prohibition of Discrimination: Employers, health insurers and other organizations are prohibited from discriminating against individuals based on their genetic information, such as denying employment or insurance coverage.
• Data Security: Genetic data must be securely stored and protected to prevent unauthorized access, use or disclosure.
• Right to Delete Genetic Data: Individuals have the right to request that their genetic information be deleted when it is no longer needed for the purpose for which it was collected.
• No Disclosure Without Consent: Genetic information cannot be sold, leased, or disclosed to third parties without the explicit consent of the individual.

Who Does GIPA protect?

GIPA protects any individual whose genetic information is collected, used, or stored in Illinois, including:

• Illinois Residents: The law applies to individuals who are residents of Illinois, regardless of where the data is being collected.
• Any Person Whose Genetic Information is Collected in Illinois: The law also applies to individuals who may not be Illinois residents but have their genetic information collected while physically present in Illinois.

What Constitutes a GIPA Violation?

A violation of GIPA occurs when an organization or company fails to comply with the specific provisions set forth in the law. Some common ways that organizations violate GIPA include:

• Employers using genetic testing for hiring or promotion decisions without obtaining consent from the individual.
• Genetic testing companies disclosing genetic testing and results through tracking tools, including the Facebook pixel, on their website.
• Health insurers requiring genetic testing for determining coverage or premiums.
• Research organizations using genetic data without consent or disclosure.
• Companies collecting genetic data for product development (e.g., wellness programs) without clear, informed consent.

What are the Penalties for GIPA Violations?

Violators of GIPA face significant financial penalties, which may include:

• $1,000 per violation for negligent violations.
• Up to $5,000 per violation for intentional or reckless violations.
• Additionally, violators may be required to pay legal fees and costs associated with litigation.

High-Profile GIPA Cases

Henry v. SG360: A defendant was accused of requesting genetic information during a pre-employment physical. The court denied a motion to dismiss the case in May 2024.

McKnight v. United Airlines: Plaintiffs alleged that United violated GIPA by requiring employees to disclose family medical history during pre-employment physicals. The court denied a motion to dismiss the case.

Page, et al. v. Ford Motor Company: This case settled for $17,500,000.00 to resolve litigation brought on behalf of persons who alleged that Ford Motor Company solicited genetic information from employees and applicants for employment by means of Ford’s Annual/Baseline Hearing History form and/or Medical Information Authorization form in violation of the GIPA.

Williams v. Peoples Gas: Plaintiffs alleged that Peoples Gas violated GIPA by requesting family medical histories from employees who filed workers’ compensation claims.

How Almeida Law Group Helps Victims of GIPA Violations

Law firms are crucial in helping victims of GIPA violations by offering expertise in navigating genetic data privacy issues. Here are the ways we assist victims:

• Identifying Violations: We can assess whether a company has violated GIPA by collecting, using or sharing genetic data without proper consent or legal compliance.
• Filing Lawsuits: We file class action lawsuits on behalf of individuals affected by GIPA violations, seeking substantial compensation for statutory damages.
• Negotiating Settlements: We negotiate settlements with companies accused of violating GIPA, securing compensation for those affected.
• Defending Victims’ Rights: We advocate for victims, ensuring that their rights under GIPA are upheld, especially when companies attempt to dismiss claims or violate legal protections.