This browser is not actively supported anymore. For the best passle experience, we strongly recommend you upgrade your browser.
Insights Insights
| 1 minute read

Illinois Continues to Entertain Innovative Privacy Claims

Did you know that Illinois has a state privacy statute that specifically protects genetic information? The state and state courts have been on a tear recently under the state's BIOMETRIC data privacy statute; but now we have some activity in the federal courts in Illinois under the state's GENETIC data privacy law. It is noteworthy in that it doesn't involve a hack or other unauthorized acquisition or use of data. Rather, the case arose in the context of a corporate acquisition: is now owned by a private equity group, which purchased via a stock sale.  

Why It Matters

Most privacy claims tend to arise in the context of an event that everyone agrees was bad: a hack, a leak, a misconfigured security setting that allows data to become accessible. This case, however, concerns an otherwise lawful and acceptable transaction -- sale of a business -- when its assets just happen to contain protected information. In this case, that personal information also just happens to be subject to a state law requiring prior written consent before disclosure or release of it.  

Most corporate privacy policies have a "savings clause" stating that they will convey any personal information they possess to a buyer in the case of a buyout. And most companies possess rather innocuous personal information: contact and shipping data, for example, probably do not raise the same kinds of policy concerns that genetic data do. All that aside, however, it is interesting to watch a live case evolve that considers the fate of that genetic data in a corporate acquisition: is it just an asset under new ownership via a change in control? Or must the seller first obtain affirmative consent to sell its company when there are such assets in its possession? Time will tell, but any entity such as a medical practice, health clinic, testing facility, or other business that collects genetic information is urged to understand whether the Illinois law applies to their information assets, and what the most onerous scenario would be to transfer control of that information to a new owner.   

A three-judge panel heard oral arguments Monday by a putative class seeking to revive its lawsuit claiming the investment giant compelled Ancestry to disclose the genetic information of its users as part of that acquisition, violating class members' rights under the Illinois Genetic Information Privacy Act. The act prohibits the disclosure, release or transfer of genetic information to unauthorized third parties without advanced written consent.


data security and privacy, hill_mitzi, insights, health care, mergers and acquisitions, corporate and business