Employers Beware: Sudden Spike in Class Actions Under the Illinois Genetic Information Privacy Act

At a Glance

• At least 20 class action lawsuits have been filed in 2023, representing a sharp spike in GIPA litigation. 
• The plaintiffs’ bar may be testing whether GIPA is a better vehicle for class actions related to the collection of genetic information than GINA, the law’s federal counterpart. 
• If these lawsuits are successful, GIPA’s steep damages and private right of action could make this a burgeoning new field of employer liability.

The Genetic Information Non-Discrimination Act of 2008 (GINA) is a federal law that regulates the collection and use of genetic information. Among other things, the law prohibits employers from requesting or requiring “genetic information” of an individual or family member of such individual. The definition of “genetic information” extends to the “manifestation of a disease” by family members, meaning that an otherwise routine medical question — “any history of cancer or heart disease in your family?” — becomes potentially problematic when asked by or on behalf of an employer. Courts have generally limited the reach of GINA to diseases that are genetic in nature, where the employer believes it is dealing with genetic information. See Baum v. Dunmire Prop. Mgmt., Inc., No. 21-CV-00964-CMA-NYW, 2022 WL 889097, at *7 (D. Colo. Mar. 25, 2022) (citing cases). GINA claims are ill-suited to class treatment because of the individualized proof required to demonstrate a claim. See Harris v. Union Pac. R.R. Co., No. 8:16CV381, 2020 WL 4504392, at *3 (D. Neb. Aug. 5, 2020).

An earlier, lesser-known analog to GINA is the Illinois Genetic Information Privacy Act of 1998 (GIPA). Like GINA, it prohibits inquiries into family medical history as part of a ban on requesting genetic information of a person or a person’s family member. 410 ILCS 513/25(c)(1). Unlike GINA, there is little to no guidance on the scope of GIPA, but that may be about to change: at least 20 purported GIPA class actions have been filed in the last eight months, with the vast majority filed in August. This represents a steep increase in GIPA claims: just two were filed in 2021, and zero cases were filed in 2022. Common to the lawsuits filed this year are allegations that employers requested or required candidates to disclose their family medical histories before receiving employment offers. Plaintiffs allege that these questions led to their disclosure of genetic information as a condition of employment, in violation of 410 ILCS 513/25. 

While GINA contemplates a statutory cap on compensatory and punitive damages, GIPA is more draconian: it includes no cap and provides for the recovery of statutory damages of $15,000 per intentional violation and $2,500 per negligent violation. 

GIPA

GIPA prohibits employers and agents acting on their behalf from “directly or indirectly” soliciting, requesting, requiring or purchasing genetic information from a person as a condition of employment. Employers are also prohibited from retaliating against employees who refuse to provide genetic information, and employers must treat genetic information in a manner consistent with federal law. Furthermore, employers should not disclose genetic information except under limited circumstances, such as when necessary for employee benefits administration.

The term “genetic information” is defined by reference to the federal Health Insurance Portability and Accountability Act (HIPAA) regulations. In essence, genetic information is information about the genetic tests of an individual or their family members, the manifestation of a disease or disorder in an individual or their family members, or any request for, or receipt of, genetic services or participation in clinical research that includes genetic services, by an individual or their family members.

Infancy Stage of GIPA Class Action Litigation

The Illinois legislature passed GIPA in 1998. However, remarkably few GIPA cases were brought to court (at least, cases that resulted in a decision) for almost 25 years. The first sign of litigation took place in 2021. In Bridges v. Blackstone Inc., plaintiffs sent their DNA samples via a home testing kit to Ancestry.com, which Blackstone later purchased. Plaintiffs filed a class action against Blackstone, alleging that Blackstone’s acquisition of Ancestry.com led to a violation of GIPA. Blackstone moved to dismiss in the U.S. District Court of Southern Illinois, based upon the plaintiffs’ failure to allege a claim for relief under GIPA. 

The district court dismissed the case because the plaintiffs failed to adequately show that Blackstone compelled Ancestry.com to disclose genetic data. On appeal, the Seventh Circuit agreed that it was impossible to conclude that “Blackstone compelled disclosure of protected genetic information simply by acquiring Ancestry.” Bridges v. Blackstone, Inc., 66 F.4th 687, 690 (7th Cir. 2023). While this amounted to a loss for the plaintiffs in this particular case, the district court gave the plaintiffs’ bar a win by adopting the definition of “aggrieved person” under the Illinois Biometric Information Privacy Act (BIPA). Accordingly, “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under [GIPA] in order to qualify as an ‘aggrieved’ person.” Bridges v. Blackstone, Inc., 2022 WL 2643968, at *3 (S.D. Ill. July 8, 2022) (quoting Rosenbach v. Six Flags Ent. Corp., 129 N.E.3d 1197, 1207 (Ill. 2019)).

The plaintiffs’ bar has been aggressively pursuing GIPA class actions since early this year. For example, in January, Ford was sued in Illinois state court by current and former employees who alleged Ford forced them to undergo a pre-employment physical during which they were asked to disclose their family medical history. The plaintiffs further contend that this information was used to assess risk correlated with conditions inherited from family members, which Ford then inappropriately used to generate hiring and staffing decisions.

Then, in early August of this year, a district court in the Northern District of Illinois certified a GIPA class against a company that sold DNA analysis reports to third parties. See Melvin v. Sequencing, LLC, No. 21 CV 2194, 2023 WL 4976181 (N.D. Ill. Aug. 3, 2023). Perhaps spurred by that ruling, over three days between August 30, 2023, and September 1, 2023, 11 more GIPA complaints were filed against organizations across the health care, transportation and financial industries. Typically, plaintiffs request class member statutory damages of $15,000 for each violation (intentional and/or reckless) or $2,500 for each violation (negligence).

What This Means for Companies

The plaintiffs’ bar in Illinois may be looking to use GIPA to challenge on a class-wide basis conduct that could only be challenged under GINA on an individual basis. The availability of statutory damages and the definition of “aggrieved” likely removes at least one barrier to class certification: individualized issues over whether a party was damaged. It remains to be seen whether other differences between GINA and GIPA make GIPA more dangerous.

Companies should:

• advise third-party medical providers performing employee screenings to modify their procedures and not ask employees about family medical history; 
• consider updating the indemnification obligations in contracts with such third-party medical providers; and 
• consider adding a disclaimer to their post-offer and pre-employment questionnaires that asks prospective employees not to provide any genetic information when responding to requests for medical information.

Additionally, companies should monitor how these cases develop and ensure they are complying not only with GINA, but with GIPA and any other state analogs.