Illinois Biometric Information Privacy Act BIPA: GIPA's $15,000 Cousin

A nurse in Chicago fills out a pre-employment health form. One question asks if anyone in her immediate family has ever had heart disease, diabetes, or cancer. She answers honestly, because that's what you do on a job application, right? She has no idea that question alone might be illegal for her employer to ask — and that answering it could hand her a lawsuit-sized paycheck years later.

Here's the thing nobody tells you when you're filling out a new-hire packet: your family's medical history isn't just "personal information." In Illinois, it's legally protected genetic information — meaning it counts as health data about your DNA and your relatives, even if no lab ever touched a test tube. And a law most people have never heard of, called GIPA (the Genetic Information Privacy Act), says your employer isn't allowed to ask for it. Not on a job application. Not during a physical. Not through a wellness survey that seems totally harmless.

Illinois Genetic Privacy: Understanding the Statute

How the Illinois Biometric Information Privacy Act (BIPA) Set the Template

The Illinois Biometric Information Privacy Act (BIPA) is the law that made biometric privacy a household legal topic, and it's the reason GIPA lawsuits are being taken seriously now. BIPA covers biometric identifiers — fingerprints, face scans, voiceprints, and other physical markers a person can't change — and it requires a private entity to get written consent before collecting biometric data from an employee or customer. When a company skipped that step, courts allowed individual workers to sue directly, the same private-right-of-action structure GIPA uses today. That single design choice is why the Biometric Information Privacy Act, not just GIPA, keeps getting cited as the model plaintiffs' lawyers point to first.

GIPA has been sitting on the books in Illinois since the late 1990s, quietly doing nothing while everyone focused on its flashier cousin, BIPA — the law that made companies pay out over fingerprints, face scans, and voiceprints. BIPA turned into a legal gold rush. Employers got hit with class-action lawsuits for using fingerprint time clocks without proper written consent. Some of those settlements ran into the hundreds of millions. This article is part of a series — start with Biometric Binding Id Verification Explained.

Now, according to JD Supra, plaintiffs' lawyers appear to be looking at GIPA the same way they once looked at BIPA: a law with real teeth that almost nobody is following correctly. And healthcare employers — hospitals, clinics, home health agencies, anyone running pre-employment physicals or wellness programs — are squarely in the crosshairs, because their hiring paperwork almost always brushes up against family medical history.

Let that number sink in for a second. Fifteen thousand dollars — per violation, not per lawsuit. If a company asks the same illegal question on a standard intake form used across 200 new hires, that's not one mistake. That's potentially 200 separate violations. Even the "we didn't mean to" version of breaking the law — what the statute calls a negligent violation — still costs $2,500 a pop. Multiply either number by a class of employees, and you understand exactly why lawyers are suddenly very interested in a law that's been gathering dust for 25 years.

GIPA allows for statutory damages of $2,500 per negligent violation and $15,000 per intentional or reckless violation — a damages structure that closely mirrors the one that fueled Illinois's biometric privacy litigation boom. — reported by JD Supra

Why Illinois Created GIPA — And What Went Wrong

Biometric Privacy and Genetic Privacy: Two Different Kinds of Data

Biometric privacy protects things about your body that can identify you instantly — a fingerprint, a face scan, an iris pattern. Genetic and family-health privacy under GIPA protects a different kind of sensitive information: not who you are, but what your body might be predisposed to, based on your relatives. Illinois built strong statutory damages into both frameworks because both types of data are permanent. You can change a password. You cannot change your fingerprints or your family's medical history, which is exactly why lawmakers treated biometric data and genetic data with the same seriousness.

Here's the part that actually made me sit up. GIPA wasn't written to punish employers for being nosy. It was written to protect you — specifically, to make sure people would feel safe getting genetic testing done without worrying it would cost them a job. Back when the law passed, lawmakers worried that if employers could see a genetic test showing someone was at higher risk for, say, breast cancer or Huntington's disease, they'd quietly discriminate in hiring or promotions. So the law drew a hard line: employers can't ask, can't request, and can't use that information as a condition of employment — full stop.

The irony is almost too perfect. The exact tool meant to make people feel safe getting tested is now the thing catching employers off guard, because standard hiring paperwork and workplace wellness programs quietly do the thing the law was built to prevent. A form asking "does a family member have a history of diabetes?" sounds like basic due diligence to an HR department. Legally, it's the exact question GIPA exists to ban. Previously in this series: Ticketmaster Face Data Retention Explained.

And here's a detail that should worry any employer who thinks a third-party doctor's office is a shield: it isn't. If an outside clinic conducts your pre-employment physical and asks about family history on the employer's behalf, the employer can still be on the hook. Handing the awkward question to someone else doesn't make it not your problem.

GIPA vs. BIPA: Illinois's Dual Privacy Framework

What Courts Have Said About the Biometric Information Privacy Act (BIPA)

Illinois courts have repeatedly read the Biometric Information Privacy Act (BIPA) as a strict, consumer-protective statute, meaning a company doesn't get a pass just because it meant well. A court doesn't need proof that a leaked fingerprint was actually misused before a private entity can be held liable — the violation itself, like collecting biometric identifiers without written consent, is enough. That approach is exactly what plaintiffs' lawyers now expect courts to apply to GIPA claims, since both statutes share the same private right of action and the same statutory-damages design.

People keep asking whether GIPA is "the next BIPA," and honestly, the comparison is more useful than it first sounds. Both laws share the same DNA, so to speak: both are Illinois laws, both let individual workers sue directly instead of waiting for a government agency to act (lawyers call this a private right of action — it just means you personally can take your employer to court, not just file a complaint and hope), and both punish violations automatically, without requiring proof that anyone was actually harmed. That last part matters. You don't need to show the employer used your family's cancer history to deny you a promotion. You just need to show they asked for it, or stored it insecurely, in the first place.

That's a very different standard than the federal version of this law, called GINA, which is narrower and harder to win under. GIPA goes further, covers more, and gives Illinois workers a sharper sword. If you've ever wondered whether a company quietly collecting your health details could actually come back to bite them — this is the answer. Yes. And it might already be sitting in a filing cabinet or a cloud folder somewhere, waiting for someone to notice.

If you want one thing to actually watch for: next time you fill out a pre-employment physical or a "voluntary" wellness survey at work, notice whether it asks about anyone besides you. Your own symptoms, your own diagnoses — that's one thing. A question about your parents, siblings, or children's health history is a different animal entirely, and in Illinois, it's a question your employer probably shouldn't be asking at all. That single distinction — you versus your family — is the line the whole law is built around. Up next: Your Real Id Can Still Be Used To Steal 47 Billion Heres The.

What Employers Are Being Told to Do About It

The compliance advice going around right now boils down to five moves: audit every application and intake form for hidden family-history questions, strip those questions out entirely, rework wellness programs so they don't collect data they don't need, train HR staff and outside medical providers who conduct physicals on the company's behalf, and keep records proving the company actually did all of the above. None of that is complicated. What's striking is that it took a wave of lawsuits to get healthcare employers — companies that live and breathe medical privacy rules every single day — to actually look at their own hiring paperwork.

What gets me about this story isn't the lawsuits or the dollar figures. It's the gap between how routine these forms feel and how serious the law says they actually are. Nobody filling out a hiring packet thinks twice about a box asking "any family history of illness?" It reads like small talk. Legally, in Illinois, it reads like a $15,000 mistake waiting for someone to notice. The real question isn't whether GIPA becomes the next BIPA. It's how many hiring forms, sitting in HR drawers right now, are already breaking a law nobody bothered to read.

It helps to understand what counts as a biometric identifier under Illinois biometric information privacy act BIPA in the first place. The statute covers fingerprints, retina and iris scans, voiceprints, and hand or face geometry — physical measurements a person carries for life and can't reset like a stolen password. Biometric information, meaning any data generated from those identifiers, gets the same protection even after it's converted into a digital template. That's why a company storing "faceprint math" instead of an actual photo still needs written consent under the Biometric Information Privacy Act.

Under the Illinois Biometric Information Privacy Act, a private entity in possession of biometric data also has to publish a written retention schedule and a destruction guideline, then actually follow it. Biometric data can't just sit on a server indefinitely because a company forgot to delete it. Illinois lawmakers wrote this requirement because biometric identifiers are permanent, so poor storage practices create risk that never really expires on its own.

Consent is the hinge the whole Biometric Information Privacy Act turns on. Before collecting biometric information, a private entity must tell the person in writing why the data is being collected, how long it will be kept, and get written consent signed before any scan happens. Skipping that step, even for something as ordinary as a fingerprint time clock, is what has generated so much litigation. Illinois courts have said the harm is the missing consent itself, not just what happens to the data afterward.

Biometric privacy claims under BIPA move through Illinois courts differently than an ordinary negligence case. A plaintiff doesn't need to prove a data breach or identity theft actually occurred; they only need to show the biometric identifiers or biometric information were collected without the required written consent. This is one reason biometric privacy litigation grew so quickly in Illinois compared to states without a similar private right of action.

Employers who use fingerprint scanners, facial recognition badge systems, or voice-authentication phone lines are the most common defendants named in a BIPA claim. Retailers, staffing agencies, and healthcare systems have all faced lawsuits because a fingerprint clock or badge scanner collected biometric data before written consent was properly documented. The lesson employers keep learning the hard way is that convenience technology still has to pass through the same consent paperwork the statute requires.

Statutory damages under the Biometric Information Privacy Act (BIPA) run in a tier system: $1,000 for a negligent violation and $5,000 for an intentional or reckless one, according to how Illinois courts have described the statute in litigation coverage. That's a lower ceiling than GIPA's $15,000 cap, but BIPA claims often involve far more violations per company, since a single fingerprint clock can log thousands of scans across a workforce. Multiply a modest per-violation number by a large employee base, and the total exposure can still reach into the millions.

None of this means every biometric or genetic privacy question is automatically a lawsuit waiting to happen. A person who understands what illinois biometric information privacy act BIPA actually requires can build hiring and timekeeping systems that collect only what's needed, get consent in writing, and delete data on schedule. The employers avoiding the biggest court exposure right now are the ones treating both BIPA and GIPA compliance as basic paperwork hygiene, not an afterthought bolted on after a demand letter arrives.