Illinois Continues to Entertain Innovative Privacy Claims

Did you know that Illinois has a state privacy statute that specifically protects genetic information? The state and state courts have been on a tear recently under the state's BIOMETRIC data privacy statute; but now we have some activity in the federal courts in Illinois under the state's GENETIC data privacy law. It is noteworthy in that it doesn't involve a hack or other unauthorized acquisition or use of data. Rather, the case arose in the context of a corporate acquisition: Ancestry.com is now owned by a private equity group, which purchased Ancestry.com via a stock sale.  

Why It Matters

Most privacy claims tend to arise in the context of an event that everyone agrees was bad: a hack, a leak, a misconfigured security setting that allows data to become accessible. This case, however, concerns an otherwise lawful and acceptable transaction -- sale of a business -- when its assets just happen to contain protected information. In this case, that personal information also just happens to be subject to a state law requiring prior written consent before disclosure or release of it.  

Most corporate privacy policies have a "savings clause" stating that they will convey any personal information they possess to a buyer in the case of a buyout. And most companies possess rather innocuous personal information: contact and shipping data, for example, probably do not raise the same kinds of policy concerns that genetic data do. All that aside, however, it is interesting to watch a live case evolve that considers the fate of that genetic data in a corporate acquisition: is it just an asset under new ownership via a change in control? Or must the seller first obtain affirmative consent to sell its company when there are such assets in its possession? Time will tell, but any entity such as a medical practice, health clinic, testing facility, or other business that collects genetic information is urged to understand whether the Illinois law applies to their information assets, and what the most onerous scenario would be to transfer control of that information to a new owner.