Illinois' Genetic Information Protection Act (GIPA) isn't new, but your exposure under it probably is. If you're collecting genetic data for AI training, research partnerships, or product development, GIPA creates the same statutory damage structure that turned BIPA into a class-action engine. The difference: genetic information is immutable, predictive, and embedded in systems that generate ongoing commercial value.
This checklist helps you assess whether your current genetic data practices meet GIPA's consent-centric requirements before litigation forces the conversation.
Prerequisites
Before you start this checklist, you need:
A complete inventory of genetic data assets. You can't comply with what you can't see. Map every dataset containing genetic information, including legacy data from acquisitions, third-party research collaborations, and AI training repositories.
Access to original consent documentation. GIPA violations stem from authorization gaps, not just security failures. You need the actual consent forms individuals signed, not summaries or attestations from data vendors.
Cross-functional participation. This isn't a privacy-only exercise. You need representatives from legal, AI/ML engineering, M&A integration, product development, and vendor management. GIPA exposure lives in how systems use data, not just how they store it.
Checklist Items
1. Verify Specific Written Authorization for Every Genetic Dataset
Requirement: GIPA prohibits disclosure, redisclosure, or transfer of genetic data without specific written authorization from the individual tested.
Action: Pull consent documentation for each genetic dataset. Confirm that authorization explicitly names the current use case, not a generalized research purpose or clinical diagnosis.
Good looks like: Every dataset links to a signed consent form that specifically authorizes your company's current use. If you're using genetic data to train an AI model for drug discovery, the consent form explicitly permits AI training and drug development applications.
2. Map Data Flows from Collection Through All Downstream Uses and Transfers
Requirement: GIPA applies to disclosure, redisclosure, and transfer. Each handoff requires authorization.
Action: Document every point where genetic data moves: from collection to storage, from storage to analytics platforms, from analytics to third-party partners or affiliates. Identify which transfers were explicitly authorized and which rely on implied permissions or general privacy policies.
Good looks like: A flowchart showing every data transfer, with each arrow annotated with the specific consent clause that permits that transfer. No transfers rely on "legitimate interest" or "compatible use" reasoning.
3. Assess AI Training Datasets for Consent Scope Alignment
Requirement: Genetic data embedded in AI models constitutes ongoing use, not one-time processing.
Action: For every AI model trained on genetic data, compare the training purpose against the original consent scope. Flag models where consent authorized clinical diagnosis but data now powers commercial prediction engines.
Good looks like: AI models are segregated by consent scope. Models trained on data authorized for "research to improve diagnostic accuracy" don't also power consumer-facing genetic risk prediction tools without separate, explicit authorization.
4. Audit Third-Party and Affiliate Data-Sharing Agreements
Requirement: GIPA treats redisclosure as strictly as initial disclosure. Sharing genetic data with partners, vendors, or corporate affiliates requires specific authorization.
Action: Review every data-sharing agreement, licensing arrangement, or research collaboration involving genetic information. Confirm that individuals authorized sharing with the specific named recipient, not a generic "approved partners" category.
Good looks like: Each third-party agreement maps to consent language that names the recipient class or specific entity. If you share genetic data with a contract research organization, the consent form explicitly permits sharing with CROs for the stated research purpose.
5. Review M&A Integration for Inherited Genetic Datasets
Requirement: Acquiring a company with genetic data means acquiring its GIPA compliance posture, including latent violations.
Action: For any acquisition in the past 36 months involving genetic data assets, conduct post-closing consent verification. Identify datasets where consent provenance is unclear or where original authorization doesn't cover your current use.
Good looks like: Integration checklists include genetic data consent audits before datasets migrate to your systems. Datasets with unclear authorization are quarantined pending consent remediation or legal review, not merged into production environments.
6. Implement Retention and Destruction Controls Tied to Authorized Uses
Requirement: GIPA's confidentiality framework implies that genetic data retention must align with the authorized purpose.
Action: Establish retention schedules for genetic datasets based on consent scope, not generic data retention policies. When the authorized purpose concludes, destroy or re-consent.
Good looks like: Genetic data doesn't persist indefinitely in analytics environments after research projects close. Automated workflows flag datasets approaching the end of their authorized use period and trigger destruction or re-authorization workflows.
7. Document De-identification Methods and Re-identification Risk Assessments
Requirement: While GIPA doesn't explicitly address de-identification, genetic data is inherently identifying. Courts evaluating biometric privacy claims have expressed skepticism toward de-identification defenses.
Action: If you rely on de-identification to reduce GIPA exposure, document your methodology and conduct regular re-identification risk assessments. Test whether your "anonymized" genetic data can be re-identified when combined with other datasets you maintain.
Good looks like: Annual re-identification testing using current techniques. If testing shows re-identification is feasible, you treat the dataset as identifiable and apply full GIPA controls, regardless of technical anonymization steps.
8. Model Statutory Damage Exposure at Scale
Requirement: GIPA provides statutory damages similar to BIPA: $1,000 per negligent violation and $5,000 per reckless or intentional violation.
Action: Calculate worst-case exposure by multiplying the number of individuals in your genetic datasets by potential per-violation damages. Model scenarios where each unauthorized use, transfer, or retention period constitutes a separate violation.
Good looks like: Your risk register includes a GIPA exposure calculation that treats each individual's genetic data as a separate violation vector. This number informs whether to pursue remediation, obtain new consents, or divest high-risk datasets.
Common Mistakes
Treating HIPAA compliance as GIPA compliance. HIPAA's de-identification safe harbors and research exceptions don't translate to GIPA. GIPA requires specific written authorization regardless of HIPAA compliance status.
Assuming research exceptions apply broadly. GIPA contains no sweeping research or commercialization exception. If your consent authorized "medical research" but you're now monetizing genetic data through AI licensing, you're likely outside the original authorization scope.
Relying on acquisition reps and warranties alone. Sellers may warrant GIPA compliance without actually auditing consent documentation. Post-closing violations still create acquirer liability, even with indemnification provisions.
Using privacy policies as consent proxies. GIPA requires specific written authorization, not notice-and-choice frameworks. A privacy policy stating "we may use your data for research" doesn't satisfy GIPA's consent standard.
Next Steps
If this checklist reveals gaps, prioritize remediation based on exposure scale and data use. Datasets powering commercial AI models or involved in active third-party partnerships create higher immediate risk than archived research data.
For high-risk datasets where consent is absent or unclear, consider:
- Obtaining new, GIPA-compliant authorization if you maintain ongoing relationships with data subjects
- Segregating datasets by consent scope to prevent unauthorized cross-use
- Engaging litigation counsel before expanding genetic data uses into new AI applications or commercial partnerships
BIPA taught that statutory privacy regimes governing biological data create existential risk when companies scale first and rationalize compliance later. GIPA carries the same structural features, amplified by AI's persistent use of embedded genetic information. The companies that treat genetic data as a high-risk asset now won't be the ones explaining consent gaps to plaintiffs' counsel later.
