Chicago Business Litigation Lawyer Blog
A clinic across town conducts pre-employment physicals for your company. The clinic’s intake form asks routine medical questions, including a section on family medical history. Two years later a class action arrives, naming your company under a statute most Illinois employers had not heard of three years ago. The complaint says you required disclosure of genetic information by asking, through the clinic, about heart disease, diabetes, and cancer in the applicant’s parents and siblings. The demand letter multiplies $15,000 per intentional violation by the number of applicants over the last several years and arrives at a number that looks like the cost of the lawsuit settling itself.
The statute is the Illinois Genetic Information Privacy Act, 410 ILCS 513, and the wave of cases under it is real. By industry counts, more than fifty putative class actions were filed in 2023 alone, and the filings have continued. The plaintiffs’ bar is treating GIPA as the new BIPA, with one important difference. The damages are higher. GIPA’s private right of action lets a court award $2,500 per negligent violation and $15,000 per intentional or reckless violation, plus attorney fees and costs, two and a half to three times BIPA’s $1,000 and $5,000 amounts. For an employer that screens dozens or hundreds of applicants each year, the math is exactly as alarming as it sounds.
It is also not the math the law has settled on. GIPA litigation is several years younger than BIPA litigation, and the doctrinal walls are still being built. But early defense decisions, statutory text the plaintiffs’ bar tends to underplay, and standard federal-court tools already give Illinois employers more leverage than the demand letter suggests.
Start with what GIPA actually prohibits. Section 25, 410 ILCS 513/25, bars an employer from directly or indirectly soliciting, requesting, requiring, purchasing, or otherwise obtaining genetic information of an individual or a family member as a condition of employment or for use in employment decisions. Section 10 defines genetic information, in language borrowed from federal law, to include the manifestation of a disease or disorder in family members of the individual, which is the legal phrase for family medical history. Section 30 restricts disclosure of genetic testing and information. Section 40 supplies the right of action and the liquidated damages.
The first defense is the one most employers miss. GIPA does not prohibit collection of the applicant’s own personal medical history. It prohibits collection of genetic information, which as a matter of statutory definition is information about the applicant’s genetic tests, the genetic tests of family members, or family medical history, the disease history of family members. An intake form that asks an applicant whether the applicant has had hypertension, diabetes, or back surgery is asking about the applicant. It is not asking about family. The same form that asks whether the applicant’s parents, siblings, or grandparents have had heart disease or cancer is asking about family medical history and is in GIPA’s territory. The distinction is not cosmetic. It can be the difference between liability and a routine occupational-health question.
The second defense comes from the leading appellate decision interpreting GIPA’s reach. In Bridges v. Blackstone, Inc., the Seventh Circuit affirmed the dismissal of a putative class action arising from Blackstone’s all-stock acquisition of the genealogy company Ancestry. The plaintiffs alleged that the acquisition itself was a disclosure of their genetic information in violation of Section 30. The Seventh Circuit disagreed, holding that a run-of-the-mill corporate acquisition, without more, does not result in a compulsory disclosure of genetic information under the statute. Bridges is the first appellate decision to push back on an aggressive reading of GIPA, and its reasoning is portable. It tells defense counsel that the statute’s words mean what they say, that the conduct the plaintiff is challenging must actually fit the statutory verb being invoked, and that the courts will not stretch GIPA into every transaction or every form that touches medical information in a tangential way.
The third defense is Article III standing in federal court. After TransUnion LLC v. Ramirez, a federal class action cannot proceed on a bare statutory violation without a concrete injury for each class member. A plaintiff who completed a pre-employment physical, received the job, and suffered no adverse consequence from the family-history questions may still claim a privacy intrusion sufficient for state court, but the federal-court door is narrower. Defendants sued in or removed to federal court should evaluate whether the case belongs there, because forcing a marginal injury into Article III scrutiny can shut down the action altogether, while a careless removal can hand the plaintiff a federal forum the plaintiff never earned.
The fourth defense is the question of who actually did the asking. GIPA reaches the employer who solicits or requires the information. Where a separately contracted occupational-health provider conducted the physical and gathered the history under its own protocols, with the employer receiving only a fitness-for-duty conclusion and no genetic information, the chain of liability the statute imagines is not the chain the case presents. The plaintiff has to plead and prove that the employer, not an unrelated medical provider, did the soliciting or requiring. That fact pattern is more common than the complaints suggest.
The fifth defense is class certification under Rule 23 and its state equivalent. Whether GIPA was actually violated turns on what questions were asked, by whom, of which applicants, and what information was actually communicated to or used by the employer. Those are individualized inquiries. A class made up of every applicant who completed a physical over the last several years is unlikely to share a single set of facts that resolves liability for all of them. Predominance, the hardest part of class certification in privacy cases, is doing real work here, and a defense that frames the question early can sometimes prevent certification before merits discovery ever begins.
Three things matter in the first week of a GIPA case. Pull the intake forms and the vendor contracts, because the actual text of the questions and the scope of the medical provider’s engagement decide most of these cases more than any abstract legal theory. Calendar an immediate change to forms going forward, because GIPA is a moving target and every additional applicant subjected to the old form is potential exposure that did not need to exist. And evaluate forum and class theory together, because the right move is not always the obvious one, and the choice between a state-court intrusion claim that asks for thousands of dollars per person and a federal-court claim that asks for tens of thousands but may lack standing alters the entire shape of the case.
GIPA’s damages provisions were designed to deter, and they do deter. They also frame demand letters that overstate what the statute actually reaches. Most of the wave will turn on intake-form text, vendor relationships, family-history questions, and the limits the courts have begun to enforce. An Illinois employer that brings discipline to that analysis is in a far stronger position than the one that treats the first demand letter as a settlement offer with a deadline.
At DiTommaso Lubin, P.C., we defend Illinois employers against Genetic Information Privacy Act class actions and the broader wave of Illinois privacy litigation, from intake-form audits and vendor-contract review through dispositive motions, class certification, and resolution. If your company conducts pre-employment physicals, fitness-for-duty exams, or other medical screenings, the time to evaluate your exposure under GIPA is before the next applicant signs the next form. Call DiTommaso Lubin, P.C. at 630-333-0333 for a free consultation, or contact us online. We can help your company defend a GIPA case and tighten the process that prevents the next one. This post is for general information and is not legal advice.