Genetic Data Privacy Violation

If a company collected, shared, or exposed your genetic information without your permission, you may have legal options. Genetic data privacy violation claims can involve genetic testing companies, employers, healthcare providers, and other businesses that handle sensitive DNA information.

The rules around genetic privacy can be complicated, but that does not mean a company gets a free pass when it mishandles your DNA or medical information. 

The Lyon Firm represents consumers in complex privacy cases and knows how to take on large companies when ordinary people are put at a disadvantage. If you believe your genetic privacy was violated, call (513) 381-2333 or fill out our online form to speak with our team about your legal options.

“The Lyon Firm was incredibly helpful and professional. I had questions about a potential case, and their team took the time to listen and offer clear, honest guidance. No pressure, just straight answers and real care. I’d call them again.”

- Celia Q. | Client

Financial Compensation in a Genetic Privacy Lawsuit

In the event of a GIPA violation, plaintiffs can seek damages of $2,500 for every negligent violation and $15,000 for every willful violation.

The financial compensation available in a genetic data privacy lawsuit can vary depending on the specific circumstances and jurisdiction. Some examples of financial awards that you may be able to recover include:

• Economic or financial losses: These could include quantifiable financial losses resulting from the unauthorized use or disclosure of genetic data. For instance, costs related to identity theft protection, medical expenses, or other economic harm may be awarded.
• Emotional harm: You may be able to recover for the emotional distress, mental anguish, or harm to reputation that you have endured.
• Lost profits or lost job opportunities: If the unauthorized use or disclosure of genetic information leads to financial losses or the denial of employment or other economic opportunities, individuals may seek financial compensation for these losses.
• Injunctive relief: Injunctive relief may be sought to halt or prevent ongoing privacy violations. This could involve a court order to stop a company from further unauthorized use or disclosure of genetic information.
• Punitive awards: Punitive awards may be available if the opposing party’s actions are deemed particularly negligent, intentional, or reckless. These are meant to punish the wrongdoer and deter similar conduct in the future.

As genetic testing companies amass vast amounts of sensitive data, questions arise regarding the proper handling, disclosure, and protection of this uniquely personal information. Genetic data privacy lawsuits have emerged as a legal recourse for individuals seeking to address the unauthorized use and disclosure of their genetic data.

These legal actions aim to hold entities accountable for privacy breaches and violations. Potential consequences range from financial compensation to injunctions and statutory penalties.

An injunction is a legal remedy issued by a court that orders a party to stop doing a particular action. Financial compensation is intended to provide a remedy for the injured party and to compensate them for the losses they have incurred.

Your biological history belongs to you, not to corporate databases, advertisers, or negligent employers. If your personal genetic details were collected, shared, or exposed without your consent, you do not have to accept it.

The Lyon Firm is ready to evaluate your situation and help you understand your legal options at no upfront cost to you. Call our office directly at (513) 381-2333 or reach out through our online contact form today to schedule your free, confidential consultation.

What Is Genetic Data Privacy?

Genetic data privacy refers to the laws and protections that govern how this information is collected, stored, used, and shared. Depending on the circumstances, those protections may come from state or federal privacy laws, consumer protection laws, employment laws, or specific genetic privacy statutes.

Genetic information can include:

• Results from DNA tests used to learn about ancestry or inherited traits.
• Genetic testing performed through a doctor or other healthcare provider.
• Information about inherited conditions or the presence of certain genetic traits.
• Family medical information that may reveal a person's risk for inherited diseases or conditions.
• DNA and other genetic data stored by testing companies, healthcare providers, laboratories, or other organizations.

What Is the Genetic Information Privacy Act (GIPA)?

Enacted in 1998, Illinois’ Genetic Information Privacy Act (GIPA) governs the confidentiality and use of genetic testing and genetic information by employers and insurers. According to GIPA, the following is considered protected data:

• Genetic tests of an individual
• Genetic tests of the family members of an individual
• Information concerning disease or disorders in family members of the individual

GIPA places limits on how genetic information can be collected, used, and shared. The law covers genetic test results and certain information about diseases or conditions that run in a family. It also covers genetic testing that analyzes DNA, RNA, chromosomes, proteins, or other biological material to identify genetic changes.

GIPA also gives employees important protections. In general, an employer cannot ask for, require, or purchase genetic testing or genetic information as a condition of employment. An employer also cannot fire or otherwise discriminate against someone because of the employee's genetic information or the genetic information of a family member.

These protections can apply to workplace wellness programs, too. An employer generally cannot require genetic testing as part of a wellness program without the employee's written authorization as required by law. The law also protects people from retaliation for raising concerns about a possible GIPA violation.

GIPA gives individuals the right to bring a lawsuit when their rights under the law have been violated. Depending on the type of violation, a person may be able to seek actual damages or statutory damages. The amount can depend on whether the violation was negligent, intentional, or reckless.

Our experience includes major privacy and data security cases involving highly sensitive health information. In the Advocate Aurora Health litigation, The Lyon Firm helped secure a $12.225 million settlement, while our work in the Reventics data security case contributed to an $8.15 million settlement.

‍These results reflect our experience handling complex privacy claims and taking on large organizations when sensitive personal information is mishandled, a background that is directly relevant to genetic data privacy cases.

When Can You Sue Over a Genetic Privacy Violation?

Not every use of genetic information is illegal. But when a company, employer, healthcare provider, or other organization collects, uses, or shares your genetic information in violation of the law, you may have grounds for a lawsuit. The specific rules depend on where you live, who has your information, and what happened to it.

For example, a potential genetic privacy claim may involve:

• Your genetic information being collected without the consent required by law.
• A company sharing or selling genetic information to another business or third party without proper authorization.
• A data breach that exposes genetic information or DNA test results.
• An employer asking for genetic information or family medical history when the law prohibits it.
• An employer using genetic information to make decisions about hiring, job assignments, promotions, or continued employment.
• A company using genetic information for a purpose that was not properly disclosed or authorized.
• A person facing retaliation after raising concerns about the improper collection or use of genetic information.

GIPA Lawsuits Against Employers

In general, an employer cannot request, require, or purchase genetic testing or genetic information as a condition of applying for or keeping a job.

An employer also cannot use genetic information to make decisions about a person's employment. This can include changing the terms or conditions of employment, limiting someone's job opportunities, or terminating employment because of genetic information about the employee or a family member.

GIPA also prohibits retaliation. An employer cannot fire or otherwise retaliate against someone for alleging a violation of the law or taking part in a proceeding involving a GIPA claim.

The law does recognize certain exceptions. For example, an employer may be able to use genetic testing as part of a workplace wellness program when the requirements of the law are met, and the employee gives the required written authorization. Other exceptions can apply to workers' compensation claims, certain law enforcement DNA testing, and genetic monitoring of toxic substances in the workplace.

What About Family Medical History?

Family medical history can be especially important in these cases. Information about diseases or conditions that run in your family can reveal sensitive details about your own genetic risks. GIPA provides protections involving certain family medical information, and other laws may apply depending on how that information was collected and used.

For example, if an employer asks you to disclose your family's medical history as part of a job application or employment process, the circumstances may raise serious privacy concerns. Whether that conduct violates the law depends on the details of the request and the law that applies.

Who Can Access Your Genetic Information?

In an ideal world, only you and your chosen healthcare providers can see your DNA analysis. In reality, modern digital networks make your data vulnerable to many outside entities:

• Telehealth Platforms and Mobile Health Apps
• Commercial DNA Testing Companies & Their Partners
• Data Brokers & Targeted Advertising Networks
• Employers and Hiring Agencies
• Life, Disability, and Long-Term Care Insurance Providers

Without strict safeguards and legal enforcement, these entities can quietly exchange your biological blueprint for profit or corporate decision-making.

When Can You Sue Over a Genetic Privacy Violation?

You do not have to wait until you suffer identity theft or lose a job to take legal action. Under state and federal protection standards, the simple act of taking, storing, or sharing your DNA details unlawfully creates grounds for a lawsuit.

You may have a strong legal claim if:

• A testing company shared or sold your biological data without clear, written consent.
• An employer asked about your family medical history during a job interview, application, or pre-employment physical.
• A lab or digital health platform suffered a preventable data breach that exposed your DNA profiles.
• A company buried consent clauses in long terms of service without giving you a direct choice to opt out.

Genetic Testing Data Privacy

Genetic testing data privacy refers to the protection of individuals’ sensitive genetic information that may be obtained through genetic testing. Genetic testing involves analyzing an individual’s DNA to identify genetic variations associated with traits, health conditions, ancestry, or other genetic characteristics. As this field advances, concerns about the privacy and security of genetic data have become increasingly prominent.

Some concerns about genetic testing data privacy that may lead to lawsuits include:

• Telehealth data breaches: A telehealth data breach is an incident in which the security and privacy of patient information are compromised within the context of telehealth services. Genetic data may be exposed during these telehealth communications.
• Genetic Discrimination: Concerns about genetic discrimination in employment, insurance, or other areas underscore the need for legal protections. Laws such as the Genetic Information Nondiscrimination Act (GINA) in the United States aim to prevent discrimination based on genetic information.
• Data collection and storage: Genetic testing companies collect and store vast amounts of genetic data. These entities need to implement robust security measures to protect against unauthorized access, data breaches, or misuse of genetic information. When a data breach occurs and affects a large number of people, a class action lawsuit may be appropriate.
• Informed consent: In the context of genetic testing, individuals should be fully aware of the purpose of the test, how their genetic data will be used, and any potential risks or implications. Genetic testing companies typically provide consent forms outlining these details.