Most readers of this site are acquainted with or at least aware of the Illinois Biometric Information Privacy Act (BIPA). In the following guest post, written by Jennifer Weinstein, Senior Claims Manager, Management Liability Claims, Intact Insurance Specialty Solutions, and Jamie Filipovic, Partner, O’Hagan Meyer, LLC, the authors explain that we are now likely going to have to be come familiar with the Illinois Genetic Information Privacy Act (GIPA), and for many of the same reasons. I would like to thank Jenn and Jamie for allowing me to publish their article as a guest post on this site. I welcome guest post submission from responsible authors on topics of interest to this blog’s readers. Please contact me directly if you would like to submit a guest post. Here is the authors’ article.
*************************
Another wave of privacy class actions has emerged in Illinois, which is a state that clearly sees itself at the forefront of privacy protection and legislation. This time, Plaintiffs’ class action bar appears to be testing the waters under Illinois’ Genetic Information Privacy Act, 410 Ill. Comp. Stat. Ann. 513/1, et seq. (hereinafter “GIPA” or “the Act”). Like the decision in Rosenbach v. Six Flags Ent. Corp., 129 N.E. 3d 1197 (Ill. 2019) that opened the floodgates for the ubiquitous class action filings under the Illinois Biometric Information Privacy Act (“BIPA”), the Seventh Circuit recently affirmed the same definition of an “aggrieved person” for GIPA claimants. See Bridges v. Blackstone, Inc., No. 22-2486, 2023 WL 3165218 (7th Cir. May 1, 2023). Specifically, the Seventh Circuit held that for a GIPA action “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights.” Bridges, 2022 WL 2643968 at *2 (citing to Rosenbach v. Six Flags Ent. Corp., 129 N.E. 3d 1197 (Ill. 2019)). Over 40 GIPA class actions have been filed this year—a stark increase considering only two GIPA cases were previously filed since its enactment in 1998.
Is the GIPA Ripe for Class Claims?
Put simply, the GIPA was enacted to prohibit discrimination based on genetic information, much like its more familiar federal counterpart, The Genetic Information Nondisclosure Act (“GINA”). The GIPA states that, “many members of the public are deterred from seeking genetic testing because of fear that test results will be disclosed without consent … or will be used in a discriminatory manner” and that “public health will be served by facilitating voluntary and confidential nondiscriminatory use of genetic testing information.” 410 Ill. Comp. Stat. Ann. 513/5 (2) and (3).
So far, courts have somewhat narrowly limited the reach of GINA to diseases that are genetic in nature, where the employer believes it is dealing with genetic information. As such, GINA has proven less conducive to class action litigation, because of the individualized proof required to demonstrate each claim.
Plaintiff’s lawyers may have a better chance at filing class claims based on GIPA violations based on the low threshold for satisfying the definition of an “aggrieved person” under the Act and the prevalence of genetic information requested by employers. In this regard, a common question on medical forms, such as, “Is there a history of heart disease in your family?” is a potential violation when asked by or on behalf of an employer.
Similarities with the BIPA
Some filed by the very same lawyers as BIPA class actions, the Plaintiffs’ bar is utilizing a similar format as in these GIPA complaints. Specifically, they allege that employers, like Tyson Foods, Inc. and The Chicago Transit Authority (“CTA”), solicit, request, or require employee disclosure of genetic information. These cases demand generous statutory damages for GIPA violations arising out of required pre-employment physical exams, interviews, and questionnaires seeking family medical history. Statutory damages for GIPA violations are $15,000 per intentional/reckless violation and $2,500 per negligent violation, or actual damages, whichever is greater. 410 Ill. Comp. Stat. Ann. 513/40. Attorneys’ fees may also be awarded to the prevailing party. Id.
The damages available for each GIPA violation are higher than the damages available for each BIPA violation. However, unlike BIPA, where the Illinois Supreme Court held that each time an employee clocks in and clocks out may constitute a violation, under the GIPA, employers are typically collecting this information just once at pre-employment. As such, if damages are awarded, the total amount per person would likely be less. What remains to be seen is how Illinois courts will interpret the damages available under GIPA—i.e., whether the damages are mandatory or discretionary like they are in the BIPA in light of the White Castle decision. The language of the GIPA, like BIPA, says a prevailing party may recover for each violation. 410 Ill. Comp. Stat. Ann. 513/40(a) (emphasis added). As such, damages do not appear to be mandatory based on the plain language of the Act.
Implications for Employers
While the BIPA has had perhaps the biggest impact on Illinois employers, the GIPA is more nuanced. In addition to employers, the Act addresses the use of genetic testing and information for insurance purposes, paternity proceedings, treatment, payment and healthcare operations and health oversight activities, including criminal investigations and proceedings. Nonetheless, many of the class actions are being filed by Illinois employees against their employers.
In part, the Act states that an employer, employment agency, labor organization and licensing agency shall not: (1) solicit, request, require or purchase genetic testing or information of a person or family member or administer a genetic test as a condition of employment, preemployment application, labor organization membership or licensure; (2) affect terms, conditions, or privileges of employment or terminate said employment, labor organization membership, or licensure because of genetic testing or information; (3) limit, segregate or classify employees that would deprive the employee with respect to genetic information or testing; (4) retaliate against any person alleging a violation; (5) offer a benefit (including employment) in exchange for taking a genetic test; (6) use genetic information or testing in a corporate wellness program with few exceptions and written authorization; and, (7) a person shall not sell to or interpret a genetic test of an employee to an employer, with few exceptions. 410 Ill. Comp. Stat. Ann. 513/25. Employers can use genetic information to monitor the biological effects of toxic substances in the workplace with appropriate consent and after satisfying certain other requirements under the Act. 410 Ill. Comp. Stat. Ann. 513/25.
Mitigating the Risk for Employers
What can employers do to mitigate their risk under the GIPA? First, employers should analyze whether it is necessary to do pre-employment medical questionnaires and assessments, and if so, to confirm that such requests are narrowly tailored to the duties of the position. Employers should also determine if the benefit of such questionnaires and assessments outweighs the risk of requesting and collecting genetic information in Illinois. If the answer is yes, employers should consider adding the following to their policies and procedures: (1) Review all employee questionnaires and remove any requests for family medical history or questions that could lead to an employee providing such information; (2) Add a statement to any application or form that the prospective employee fills out advising them not to include any genetic information for themselves or their family in their responses; (3) If the employer uses a third party, consult with counsel about whether the third party provider contract complies with the Act; and (4) Determine, after consulting with counsel, whether to include indemnification language in contracts with third parties conducting pre-employment physicals for violations of the Act.
Much like BIPA, GIPA could have an impact on an employer’s insurance program. GIPA claims may be noticed under employers practices liability, directors & officers liability, general liability, and/or fiduciary liability policies. GIPA claims are starting to gain momentum in Illinois, although it has yet to be determined if GIPA claims will have a similar impact as BIPA had on the insurance industry.