Summary
standing requires an injury in fact that is fairly traceable to the defendant's conduct
Summary of this case from Davis v. City of ChicagoOpinion
No. 20-3134
07-11-2023
Matt DINERSTEIN, individually and on behalf of all others similarly situated, Plaintiff-Appellant, v. GOOGLE, LLC; University of Chicago; and University of Chicago Medical Center; Defendants-Appellees.
Ryan D. Andrews, Roger Perlstadt, Alexander Glenn Tievsky, Attorneys, Edelson P.C., Chicago, IL, for Plaintiff-Appellant. Jeffrey T. Norberg, Attorney, Neal & McDevitt, LLC, Northfield, IL, Michael Graham Rhodes, Attorney, Cooley LLP, San Francisco, CA, for Defendant-Appellee Google, LLC. Brian D. Sieve, Michael B. Slade, Esq., Attorneys, Kirkland & Ellis LLP, Chicago, IL, C. Harker Rhodes, IV, Attorney, Kirkland & Ellis LLP, Washington, DC, for Defendants-Appellees University of Chicago, University of Chicago Medical Center.
Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 19 C 4311 — Rebecca R. Pallmeyer, Chief Judge. Ryan D. Andrews, Roger Perlstadt, Alexander Glenn Tievsky, Attorneys, Edelson P.C., Chicago, IL, for Plaintiff-Appellant. Jeffrey T. Norberg, Attorney, Neal & McDevitt, LLC, Northfield, IL, Michael Graham Rhodes, Attorney, Cooley LLP, San Francisco, CA, for Defendant-Appellee Google, LLC. Brian D. Sieve, Michael B. Slade, Esq., Attorneys, Kirkland & Ellis LLP, Chicago, IL, C. Harker Rhodes, IV, Attorney, Kirkland & Ellis LLP, Washington, DC, for Defendants-Appellees University of Chicago, University of Chicago Medical Center. Before Sykes, Chief Judge, and Flaum and Kirsch, Circuit Judges. Sykes, Chief Judge.
This class-action lawsuit arises from a research collaboration between Google and the University of Chicago together with its affiliated Medical Center. (We will refer to the latter two as "the University" unless the context requires otherwise.) Harnessing the power of artificial intelligence, the research partners aspired to develop software capable of anticipating patients' future healthcare needs. If successful, the software promised to reduce medical complications, eliminate unnecessary hospital stays, and, ultimately, improve patients' healthcare outcomes.
As an initial step in the research effort, the University delivered several years of anonymized patient medical records to Google, thus supplying it with the information needed to "train" the software's algorithms. A Data Use Agreement governed the transfer. Restricting Google's use of the records to a list of specific research-related activities, the agreement expressly prohibited the company from attempting to identify any patient whose records were disclosed.
The anonymized electronic records subject to the agreement included those of Matt Dinerstein, twice an inpatient at the hospital during the period covered by the records disclosure. Dinerstein sued Google and the University on behalf of himself and a class of other patients whose anonymized records were disclosed. He alleged several theories of liability. He first claimed that the University had breached either an express or an implied contract traceable to a privacy notice he received and an authorization he signed upon each admission to the Medical Center. Alternatively, he asserted a claim for unjust enrichment. Citing the same notice and authorization, he also alleged that the University had reneged on its promise of patient confidentiality and therefore violated the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 ILL. COMP. STAT. 505/1 et seq. Against Google, he asserted claims for unjust enrichment and tortious interference with his contract with the University. Finally, he brought a privacy claim against all defendants based on allegations of intrusion upon seclusion.
The district judge dismissed the consumer-fraud claim for lack of standing and the rest of the suit for failure to state a claim. We agree with her decision to dismiss the case, but our analysis begins and ends with standing. Dinerstein has not adequately alleged standing to pursue any of his claims. To sue in federal court, a plaintiff must plausibly allege (and later prove) that he has suffered an injury in fact that is concrete and particularized, actual or imminent, and traceable to the defendant's conduct. The injuries Dinerstein alleges lack plausibility, concreteness, or imminence (or some combination of the three). Because the complaint fails to plausibly allege an injury in fact, we affirm but modify the judgment to reflect a jurisdictional dismissal for lack of standing.
I. Background
Our factual account is drawn from Dinerstein's amended complaint. We begin with a description of his inpatient stays at the University Medical Center—and more particularly, the paperwork he received at the start of each admission. Dinerstein alleges that he was first admitted to the Medical Center on June 4, 2015, and was discharged three days later. He was then readmitted on June 25, this time for a two-night stay. Upon each admission Dinerstein received a Notice of Privacy Practices detailing the University's confidentiality obligations and the circumstances in which it might use or disclose patient medical information. Relevant here, the notice stated that the University would obtain "written permission" for the sale of such information. Patient permission was not required, however, for the University to use or share the information in limited research-related circumstances. In addition to the notice, Dinerstein received and signed an Admission and Outpatient Agreement and Authorization. By doing so he affirmed that he understood that his medical information might be shared for approved research purposes and that if so, he would "not be entitled to any compensation." He further acknowledged that "all efforts" would "be made to protect [his] privacy" and that "any use of [his] medical information" would comply with both the notice and "federal and state laws."
During Dinerstein's two hospital stays, the University compiled records of his vital readings, medical procedures, prescriptions, test results, and diagnoses. The records also contained demographic information. After each discharge from the hospital, the Medical Center maintained electronic copies of his patient records.
Approximately two years after Dinerstein's hospital visits, Google announced that it had partnered with the University to research new healthcare technology. With the help of machine learning, the research partners aspired to develop predictive modeling software that would improve the ability of medical providers to forecast their patients' medical needs and, in turn, to tailor subsequent medical care. As described in promotional statements, the project had the potential to prevent medical complications, reduce hospital visits, and improve overall health and well-being.
Matt Wood, UChicago Medicine Collaborates with Google to Use Machine Learning for Better Health Care, UCHICAGO MEDICINE (May 17, 2017), https://www.uchicagomedicine.org/forefront/research-and-discoveries-articles/uchicago-medicine-collaborates-with-google-to-use-machine-learning-for-better-health-care.
To reliably predict medical outcomes, the models needed extensive information from which to learn. The University thus agreed to transfer to Google a large set of anonymized patient medical records. A Data Use Agreement executed by the partners in December 2016 governed the transfer. While most of the agreement's provisions are irrelevant for our purposes, a few deserve mention. First, the agreement contemplated that before disclosure the University would strip the patient records of all direct identifying information except the dates of medical events and services. Second, the agreement delineated the records' authorized uses. In particular, Google was permitted to use the records only to identify key medical information, to develop predictive models, and to assess the models' efficacy. It could neither disclose information from within the records nor use the records in contravention of federal law. Most importantly, the agreement strictly prohibited Google from using the records "to identify any individual." Third, if the parties' research efforts proved successful, the agreement granted the University a perpetual license to use the predictive models for its own "internal non-commercial research purposes."
The batch of medical records covered by the Data Use Agreement spanned several years. Specifically, the agreement directed the University to transfer to Google anonymized records generated from all inpatient, outpatient, and emergency adult-patient encounters between January 1, 2010, and June 30, 2016. Both of Dinerstein's overnight stays occurred in June 2015, so his medical records were included in the set disclosed to Google. Dinerstein alleges that the University never obtained his consent—written or other-wise—for the third-party record disclosure. Nor did Google seek permission to use his records.
Dinerstein filed suit against the University and Google seeking damages and injunctive relief on behalf of himself and a class of patients whose anonymized records were disclosed. He raised seven claims for relief. Against the University he alleged claims for breach of an express or an implied contract premised on the notice he received and the authorization he signed upon each admission to the Medical Center. More to the point, Dinerstein alleged that in exchange for his payment and personal medical information, the University had agreed to protect and secure his information. By sharing it with Google, the University had failed to uphold its end of the bargain. As an alternative to his contract claims, Dinerstein sought damages for unjust enrichment. He also alleged a claim for violation of the Illinois Consumer Fraud and Deceptive Business Practices Act. This statutory claim rested on the alleged broken promises, which Dinerstein asserted the University never intended to keep in the first place.
Turning to Google, Dinerstein alleged that the company had tortiously interfered with his contract with the University. He also asserted a claim for unjust enrichment based on the company's receipt of valuable patient medical records. Finally, Dinerstein brought a tort claim against Google and the University for invasion of privacy. More specifically, he alleged that they had intruded upon his seclusion by sending and receiving his sensitive medical information.
Relevant to this last theory of liability, Dinerstein claimed that while he was an inpatient at the Medical Center, he had used a smartphone with geolocation capabilities. Because he had also downloaded various Google apps, he alleged that the phone granted the company access to his precise location during every moment of his hospital stays. He further alleged that if Google compared his location data with the insufficiently anonymized patient records, it could easily ascertain his identity and uncover "intimate private details" in his medical histories. And he alleged that Google could do the same thing with other class members' geolocation data.
The defendants moved to dismiss under Rules 12(b)(1) and (6) of the Federal Rules of Civil Procedure. They argued that Dinerstein had not alleged a concrete injury to support Article III standing and, alternatively, that he had not stated a cognizable claim. The judge granted the motion, agreeing primarily with the latter argument and dismissing the complaint in its entirety.
On the standing issue, the judge construed Dinerstein's allegations about a lost benefit of the bargain as sufficient to support standing to sue on the contract (and contract-alternative) theories against both the University and Google. Dinerstein v. Google, LLC, 484 F. Supp. 3d 561, 574 (N.D. Ill. 2020). She also reasoned that the allegations about an invasion of privacy—in the form of a wrongful disclosure of his private medical information—supported Dinerstein's standing to sue for intrusion upon seclusion. Id. at 575. But the judge dismissed the consumer-fraud claim for lack of standing because "[a] claim under [the Illinois Consumer Fraud and Deceptive Business Practices Act] requires a showing of actual damages," which Dinerstein had not alleged. Id. at 579 (citing 815 ILL. COMP. STAT. 505/10a(a)).
Moving on, the judge dismissed the claims for breach of contract—express or implied—for failure to state a cognizable claim because Dinerstein had not adequately pleaded economic damages, a required element under Illinois law. Id. at 590-93; FED. R. CIV. P. 12(b)(6). Next, the judge noted but chose not to decide the question whether Dinerstein's claim for tortious interference with contract necessarily fell with the other contract claims. Instead, she held that the claim failed for a separate reason: Dinerstein had not sufficiently pleaded that Google had intentionally caused the University's breach of contract. Id. at 593. (Intent is necessary to state a claim of tortious interference with contract in Illinois. HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 131 Ill.2d 145, 137 Ill.Dec. 19, 545 N.E.2d 672, 676 (1989).)
Turning to the privacy claim, the judge observed that Dinerstein had recharacterized his original intrusion-upon-seclusion claim as a novel tort claim for breach of medical confidentiality, a theory not yet recognized in Illinois. The judge thought it unlikely that the Illinois Supreme Court would recognize such a claim, so she declined to permit Dinerstein to pursue it in federal court. That left only the unjust-enrichment claims. Because unjust enrichment is not an independent cause of action in Illinois, the judge dismissed those claims as well. Dinerstein appealed.
II. Discussion
The dismissal order rests partly on a failure to allege Article III standing but mostly on the judge's conclusion that Dinerstein failed to state a claim upon which relief can be granted. Our review of either basis for dismissal is de novo. Nowlin v. Pritzker, 34 F.4th 629, 632 (7th Cir. 2022). The parties primarily focus on whether the amended complaint satisfies the statutory and common-law pleading requirements particular to each claim. But the threshold question is standing, which "is jurisdictional and cannot be waived." Nettles v. Midland Funding LLC, 983 F.3d 896, 899 (7th Cir. 2020).
Standing doctrine traces its origins to Article III of the Constitution, which grants federal courts the power to resolve "Cases" and "Controversies." U.S. CONST. art. III, § 2. The doctrine's elements are well established and familiar. To sue in federal court, a plaintiff must have suffered (1) a concrete, particularized, and actual or imminent injury (an "injury in fact") (2) that is fairly traceable to the defendant and (3) that is likely to be redressed by a favorable judicial decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). "[A]t the pleading stage, the plaintiff must clearly . . . allege facts demonstrating each element." Spokeo, Inc. v. Robins, 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) (quotation marks omitted). Moreover, "standing is not dispensed in gross; rather, plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek." TransUnion LLC v. Ramirez, — U.S. —, 141 S. Ct. 2190, 2208, 210 L.Ed.2d 568 (2021).
Like many of our recent cases concerning Article III standing, this one hinges on the injury-in-fact element, and in particular, the concreteness and imminence requirements. While the concreteness requirement examines the substance of a plaintiff's asserted injury, the imminence requirement measures its likelihood. In other words, to provide a basis to sue in federal court, an injury must exist "in both a qualitative and [a] temporal sense." Whitmore v. Arkansas, 495 U.S. 149, 155, 110 S.Ct. 1717, 109 L.Ed.2d 135 (1990).
Starting with the qualitative aspect, "[a] concrete injury must be de facto; that is, it must actually exist." Spokeo, 578 U.S. at 340, 136 S.Ct. 1540 (quotation marks omitted). Endorsing the term's "usual meaning," the Supreme Court has described a concrete injury as one that is "real[ ] and not abstract." Id. (quotation marks omitted). Both tangible and intangible harms may fit the bill, even if tangible harms like "physical or monetary injur[ies]" are perhaps more intuitively concrete. TransUnion, 141 S. Ct. at 2204. As the Court has explained, our task—especially when the plaintiff asserts an intangible harm—is to assess whether the alleged injury has "a close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts." Id. (quotation marks omitted). The inquiry asks whether the plaintiff has "identified a close historical or common-law analogue" for his asserted injury. Id. Put another way, when reviewing a plaintiff's alleged injury for concreteness, "[h]istory and tradition remain our ever-present guides." Pierre v. Midland Credit Mgmt., Inc., 29 F.4th 934, 938 (7th Cir. 2022).
Imminence is more of an "elastic concept." Lujan, 504 U.S. at 564 n.2, 112 S.Ct. 2130. While it lacks a precise framework, the basic function of the imminence requirement "is to ensure that the alleged injury is not too speculative for Article III purposes." Id. Accordingly, a plaintiff who has not suffered a past harm cannot simply rest on allegations that he may suffer some "possible future injury," Whitmore, 495 U.S. at 158, 110 S.Ct. 1717, "at some indefinite future time," Lujan, 504 U.S. at 564 n.2, 112 S.Ct. 2130. His threatened injury instead must be "certainly impending" to satisfy Article III. Id. And importantly, while an imminent risk of future harm may suffice to support standing to sue for prospective relief (i.e., an injunction), a claim for damages requires a concrete harm that has in fact occurred. Trans Union, 141 S. Ct. at 2210-11.
With these fundamental standing principles in mind, we turn to the claims presented in this case. At the outset, however, we note that Dinerstein omitted from his opening brief any discussion about the claims for unjust enrichment or breach of an implied contract. By doing so, he abandoned these claims on appeal, and we need not consider them. See White v. United States, 8 F.4th 547, 552 (7th Cir. 2021); see also FED. R. APP. P. 28(a)(8)(A) (requiring that the appellant's brief include his "contentions and the reasons for them"). What remains is the privacy claim, the claim for breach of an express contract, the consumer-fraud claim, and the claim for tortious interference with contract. We address each in turn.
A. Privacy Claim
We begin with the alleged breach of privacy because the asserted injury underlying this claim is common to all claims that remain live on appeal. In other words, our resolution of the standing issue on this claim necessarily resolves portions of others, streamlining our discussion of the claims that follow.
Before diving into the standing analysis, we must discern what, exactly, Dinerstein's privacy claim is. His complaint characterizes the defendants' conduct as a common-law intrusion upon seclusion, which is potentially actionable when the alleged tortfeasor "intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another." RESTATEMENT (SECOND) OF TORTS § 652(B) (AM. LAW INST. 1977) [hereinafter RESTATEMENT.] The Illinois Supreme Court has adopted this definition of the tort, describing the purpose of the seclusion right as "protecting a person from another's prying into their physical boundaries or affairs." W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc., 451 Ill.Dec. 1, 183 N.E.3d 47, 58 (2021); see also Lovgren v. Citizens First Nat'l Bank, 126 Ill.2d 411, 128 Ill.Dec. 542, 534 N.E.2d 987, 988-89 (1989).
Apparently accepting that neither defendant's conduct fits the elements of this tort, Dinerstein abandoned his intrusion-upon-seclusion theory below, as the district judge noted. Dinerstein, 484 F. Supp. 3d at 594. In his response to the defendants' motion to dismiss, Dinerstein reframed his privacy claim as a breach of medical confidentiality, a novel cause of action that posits a common-law duty of medical providers to maintain patient confidentiality. Several states have recognized some variety of this tort. See, e.g., Lawson v. Halpern-Reiss, 210 Vt. 224, 212 A.3d 1213, 1219 (2019); Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 327 Conn. 540, 175 A.3d 1, 17 (2018); McCormick v. England, 328 S.C. 627, 494 S.E.2d 431, 437 (S.C. Ct. App. 1997). But Illinois is not one of them. Dinerstein therefore invited the district judge, sitting in diversity, to hold that the Illinois Supreme Court would recognize the tort under Illinois law. See Zahn v. N. Am. Power & Gas, LLC, 815 F.3d 1082, 1087 (7th Cir. 2016) ([W]e must use our own best judgment to estimate how the [Illinois] Supreme Court would rule as to its law." (quotation marks omitted)). As we've noted, the judge declined that invitation. Dinerstein, 484 F. Supp. 3d at 595.
More importantly for our purposes, however, Dinerstein has chosen to stick with the new version of his privacy claim on appeal. He premises his privacy-related challenges exclusively on the novel medical-confidentiality theory. Following his lead, then, we focus our discussion of standing on the reframed privacy theory.
Dinerstein presents his privacy injury in two forms, one backward-looking and the other forward-looking. But considered in either direction—past or future—his asserted injury does not establish standing to sue.
1. Past Harm
We start with the backward-looking form of injury. Crucially, Dinerstein does not allege that Google has already used the disclosed patient records to discern his identity. Instead he focuses on the conduct of the University, arguing that the record transfer was itself an actionable invasion of his medical privacy. This is so, Dinerstein asserts, regardless of whether Google ever actually identifies him.
By referencing a common-law privacy invasion, Dinerstein attempts to compare his asserted injury to a harm "traditionally recognized as providing a basis for lawsuits in American courts." TransUnion, 141 S. Ct. at 2204. In other words, he engages with the proper inquiry under the Supreme Court's recent standing caselaw. But as we've explained, an "invasion of privacy" is not a standalone tort; the term "encompasse[s] four theories of wrongdoing: intrusion upon seclusion, appropriation of a person's name or likeness, publicity given to private life, and publicity placing a person in a false light." Pucillo v. Nat'l Credit Sys., Inc., 66 F.4th 634, 639-40 (7th Cir. 2023) (quoting Persinger v. Sw. Credit Sys., L.P., 20 F.4th 1184, 1192 (7th Cir. 2021)); see also RESTATEMENT §§ 652A-652E. And because TransUnion requires us to nail down a particular common-law analogue, we must assess whether any of the recognized privacy torts is sufficiently analogous to Dinerstein's asserted injury. If not, no concrete harm. "No concrete harm, no standing." TransUnion, 141 S. Ct. at 2214.
Of the four traditional privacy tort theories, the closest comparator to Dinerstein's new theory is probably the tort of publicity given to private life, which occurs when someone "gives publicity" to a "highly offensive" matter "concerning the private life of another" that "is not of legitimate concern to the public." RESTATEMENT § 652D. Yet Dinerstein has identified no case in which a court has permitted a plaintiff to bring a public-disclosure tort premised on the dissemination of anonymized information. Indeed, while the relevant caselaw is sparse, we're skeptical that this alleged factual scenario would give rise to any injury at all—let alone one concrete enough to support Article III standing. See, e.g., Shulman v. Grp. W Prods., Inc., 18 Cal.4th 200, 74 Cal.Rptr.2d 843, 955 P.2d 469, 489 n.12 (1998) ("[C]omplete lack of identification or identifiability would seemingly defeat a private facts claim, as there could be no injury . . . ."); Harris ex rel. Harris v. Easton Publ'g Co., 335 Pa.Super. 141, 483 A.2d 1377, 1385 (1984) ("Absent an ability to identify the complainant, there can be no communication and hence, no publicity."); cf. Frobose v. Am. Sav. & Loan Ass'n, 152 F.3d 602, 618 (7th Cir. 1998) (rejecting a false-light claim because the communication neither mentioned the plaintiff by name nor made her "readily identifiable to the public").
Nor has Dinerstein identified a case in which a court has permitted a plaintiff to bring the novel claim of breach of medical confidentiality in circumstances like these.
Resisting this conclusion, Dinerstein contends that the University's records were insufficiently anonymized. He cites a presentation from the 2017 Google Cloud Next conference by Dr. Samuel Volchenboum, the University's Associate Chief Research Informatics Officer. Dinerstein argues that Dr. Volchenboum's presentation highlighted various deficiencies in the "typical de-identification process." He contends that the process risks leaving identifying clues like the patient's age, place of residence, and family relations scattered throughout the purportedly "deidentified" medical records. According to Dinerstein, such clues are routinely found in the treating physician's "freetext" clinical notes. If these clues are pieced together, reidentification is supposedly simple.
Google Cloud Tech, Sensitive Data Management for Collaborative Research Clouds (Google Cloud Next '17), YOUTUBE (Mar. 9, 2017), https://www.youtube.com/watch?v=7Si956MXhWQ.
But Dinerstein's complaint omits any allegations linking the so-called "typical de-identification process" described in Dr. Volchenboum's presentation to the University's deidentification process here. Put differently, just because some de-identification processes might be deficient, we cannot assume that the University's process was necessarily so. To the contrary, the complaint acknowledges that the challenged record transfer occurred pursuant to the Data Use Agreement, which states that "the majority of [patient] identifiers will be removed," leaving only "actual dates of [medical] service and events." Dinerstein's allegations of insufficient anonymization therefore do not cross the plausibility threshold. See Silha v. ACT, Inc., 807 F.3d 169, 174 (7th Cir. 2015) ("[T]he Twombly-Iqbal facial plausibility requirement for pleading a claim is incorporated into the standard for pleading subject matter jurisdiction.").
Moreover, Dinerstein appears to concede that the University adequately discharged its de-identification obligation. Describing a jointly authored article from the University and Google, the complaint states that although "the [date stamps] from the University patients' records were maintained," the records otherwise had been "deidentified." And aside from the date stamps, Dinerstein does not pinpoint any information within the records that he thinks should have been redacted and was not. Nor does he allege that the date stamps alone were impermissibly identifying. At most he alleges that some personally identifying information "may have evaded redaction"—a hypothetical that does not support his repeated but conclusory assertions that the University's records were insufficiently anonymized. "Such . . . bare assertion[s] of harm—unsupported by any concrete details"—do not suffice to allege a plausible, concrete injury. Nowlin, 34 F.4th at 633.
2. Risk of Future Harm
That brings us to Dinerstein's allegations of a forward-looking privacy injury. Unlike the backward-looking injury, this injury turns on Google's conduct—or more precisely, its anticipated conduct. At bottom, Dinerstein worries that the date stamps contained in the transferred medical records, along with the geolocation and demographic data collected from his smartphone apps, offer Google a "perfect formulation of data points" for later reidentification. In other words, the record transfer created a risk that he might someday be reidentified.
To the extent that Dinerstein rests his claim for damages on allegations of future risk, the argument is a nonstarter. In TransUnion the Supreme Court clarified that unless a "risk of future harm materializes," a plaintiff may rely on an "imminent and substantial" risk of harm only when "pursu[ing] forward-looking, injunctive relief to prevent the harm from occurring." 141 S. Ct. at 2210-11 (emphasis added). Or as our court has summarized: "A plaintiff seeking money damages has standing to sue in federal court only for harms that have in fact materialized." Pierre, 29 F.4th at 938. Because Dinerstein alleges no material harm arising from the alleged risk of future reidentification, that future risk cannot support standing to sue for damages.
The alleged risk does not support standing to sue for injunctive relief either, though for a different reason: the risk Dinerstein alleges is not sufficiently imminent. To be sure, Google possesses a wealth of data about most, if not all, Americans. Yet Dinerstein ignores that the governing Data Use Agreement expressly prohibited Google from using the transferred medical records—either by themselves or in tandem with data already in its possession—"to identify any individual." And even if the contractual obligation doesn't itself foreclose the risk of reidentification, Dinerstein has not alleged that Google has taken any steps to identify him. Nor, for that matter, does he allege that Google intends to do so. Without any allegations to that effect, "we cannot simply presume a material risk of concrete harm." TransUnion, 141 S. Ct. at 2212 (quoting Ramirez v. TransUnion LLC, 951 F.3d 1008, 1040 (9th Cir. 2020) (opinion of McKeown, J.)). The risk of future injury is thus nowhere near "certainly impending"; it is too speculative to satisfy the imminence requirement for a suit for injunctive relief in federal court.
Clapper v. Amnesty International USA, 568 U.S. 398, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013), supports this holding. In Clapper attorneys and human-rights organizations raised constitutional challenges to § 1881a of the Foreign Intelligence Surveillance Act, arguing that individuals with whom they regularly communicated were probable targets of foreign electronic surveillance under the Act. Id. at 406, 133 S.Ct. 1138. Because of the possibility of surveillance, the plaintiffs claimed that their international communications were likely to be incidentally "acquired under § 1881a at some point in the future." Id. at 407, 133 S.Ct. 1138.
The Court rejected this alleged future injury as a basis for standing, reasoning that it rested on multiple layers of "highly speculative fear." Id. at 410, 133 S.Ct. 1138. In particular, the "chain of contingencies"—specifically that (1) the government would choose to target their foreign contacts pursuant to its § 1881a authority; (2) the government would succeed in both securing the requisite authorization and intercepting the targeted communications; and (3) the plaintiffs would be parties to those communications—"d[id] not satisfy the requirement that threatened injury must be certainly impending." Id. The plaintiffs had offered little more than speculation and assumptions—and importantly, "no specific facts"—that their communications would actually be acquired. Id. at 412, 133 S.Ct. 1138. So too here. Dinerstein has expressed only a "highly speculative fear" that Google might, "at some point in the future," identify him. Id. at 407, 410, 133 S.Ct. 1138.
Our decisions in Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015), and Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), are not to the contrary. As an initial matter, both predate TransUnion. While that is not to say that they are no longer authoritative, it is to recognize that TransUnion marked a shift in the Court's standing jurisprudence. But even on their own terms, Remijas and Lewert do not help Dinerstein's standing argument here. In both cases we held that the plaintiffs had sufficiently alleged a substantial risk of future harm stemming from breaches of their credit-card information. Remijas, 794 F.3d at 693-94; Lewert, 819 F.3d at 967. Motivating our decisions was the common-sense observation that hackers steal private credit-card information for a primary purpose: "to make fraudulent charges or assume . . . consumers' identities." Remijas, 794 F.3d at 693; Lewert, 819 F.3d at 967. Therefore, the plaintiffs' allegations about a substantial risk of future harm had "cross[ed] the line from conceivable to plausible." Lewert, 819 F.3d at 968 (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)).
The same cannot be said here. Absent from this case is a comparable indication—rooted in common sense or otherwise—that Google's primary purpose in obtaining the medical records was to reidentify the University's patients. Indeed, the fact that Google explicitly agreed not "to identify any individual" is enough to rule out the contention that the threat of reidentification is certainly impending. Quite the opposite; that contention is wholly speculative and implausible. It cannot supply the basis for standing.
Even if Dinerstein's asserted privacy injury—past or future—were sufficient to support standing (it is not), we see no reason to disturb the judge's decision not to recognize a novel claim for breach of medical confidentiality. Illinois courts have not yet weighed in on the issue, and "it is not our role to break new ground in state law." Roppo v. Travelers Com. Ins. Co., 869 F.3d 568, 596 (7th Cir. 2017) (quoting Lopardo v. Fleming Cos., 97 F.3d 921, 930 (7th Cir. 1996)). This is especially true with "[i]nnovative state law claims," which "should be brought in state court." Insolia v. Philip Morris Inc., 216 F.3d 596, 607 (7th Cir. 2000). But because Dinerstein lacks standing, we have no need to address this issue.
B. Contract Claim
Next we assess the alleged injuries underlying Dinerstein's claim for breach of an express contract, a claim he brings only against the University. Recall that Dinerstein roots the University's purported contractual duty in the Notice of Privacy Practices he received and the Admission and Outpatient Agreement and Authorization he signed each time he was admitted to the Medical Center. He argues that these documents contractually obligated the University to safeguard his medical information. In his view, transferring his medical records to Google was a flagrant breach of that obligation.
To support standing to bring this claim, Dinerstein asserts three injuries. The first stems from his interest in privacy—i.e., the injury we've already addressed and deemed insufficient to support standing. The second, presented in two forms, is pecuniary: Dinerstein contends that he overpaid the University for his medical treatment or, alternatively, that the University underpaid him for the interest in his medical records. The third is contractual: Dinerstein contends that the University's breach of contract is itself an actionable concrete injury.
1. Pecuniary Harms
We turn first to Dinerstein's alleged pecuniary injuries, which the Supreme Court has described as "traditional tangible harms" that "readily qualify as concrete injuries under Article III." TransUnion, 141 S. Ct. at 2204. Even if concrete, however, Dinerstein's allegations of injury must be plausible "to survive dismissal for lack of standing." Diedrich v. Ocwen Loan Servicing, LLC, 839 F.3d 583, 588 (7th Cir. 2016) (citing Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009)); see also Silha, 807 F.3d at 174. While Dinerstein alleges both an overpayment and underpayment theory of financial harm, neither is plausible and neither supplies a basis for standing.
Dinerstein's overpayment theory rests on allegations that the medical care he (more precisely, his insurer) purchased came bundled with a promise of medical confidentiality. Because the University failed to deliver on that promise, he contends that he was deprived of the full benefit of his bargain. Not only that, he also would not have purchased the University's medical treatment had he known that it intended to share his private health information.
This is not the first time we've confronted an argument like this one. In Remijas, 794 F.3d at 694-95, and Lewert, 819 F.3d at 968, the plaintiffs argued that they had overpaid Neiman Marcus and P.F. Chang's, respectively, because the companies had failed to protect their credit-card information. While we did not outright reject the plaintiffs' theories, we expressed serious skepticism. We described the plaintiffs' injuries in Remijas, for example, as "problematic." 794 F.3d at 694. And in both cases we explained that courts have not entertained the overpayment theory of injury outside the product-liability context, and we saw no need to extend it "beyond its current scope." Lewert, 819 F.3d at 968; Remijas, 794 F.3d at 695.
Dinerstein has not alleged a defect in his medical care, and we again are not inclined to recognize the overpayment theory outside the product-liability context. (In this case that would require extending it "from a particular product to the operation of [an] entire" medical facility. Remijas, 794 F.3d at 695.) Perhaps anticipating this doctrinal problem, Dinerstein tries to distinguish Remijas and Lewert, arguing that the overpayment theories in those cases were implausible because the companies had not charged an extra fee for credit-card transactions. In other words, the plaintiffs had not paid for credit-card data security. But this case is no different. It is wholly implausible—and Dinerstein alleges nothing to the contrary—that the University charged a discrete "patient-confidentiality fee." Indeed, the fact that it reserved the right to share patient medical information for approved research purposes suggests exactly the opposite. So too does the fact that Dinerstein signed a release stating that he would "not be entitled to any compensation, regardless of the value of such research or any products or inventions developed therefrom."
Dinerstein's most helpful case is from another circuit. In Carlsen v. GameStop, Inc., 833 F.3d 903, 909 (8th Cir. 2016), the Eighth Circuit held that the plaintiff had alleged an "actual" financial injury "in an amount equal to the difference between the value of [what] he paid for and the value of [what] he received, i.e., a [digital magazine] subscription with compromised privacy protection." As our decisions in Remijas and Lewert make clear, we're not inclined to extend the overpayment theory of injury to novel contexts. Regardless, Carlsen is also distinguishable for the reason we just mentioned: Dinerstein's overpayment injury is particularly implausible given his express agreement that his medical information "may be used and shared for research." And his argument that he would not have paid for the University's medical services had he known otherwise is similarly implausible.
We are even more skeptical of Dinerstein's second pecuniary theory—that the unauthorized use of his medical information conferred a financial benefit on the University to which he is entitled. This financial benefit apparently came in the form of the perpetual software license reserved for the University in the Data Use Agreement. To remedy the University's unjust benefit, Dinerstein suggests that the court could order disgorgement or "at least a reasonable royalty."
Putting aside the fact that Dinerstein agreed that he was not entitled to compensation for the use of his medical information, his asserted injury cannot supply a basis for standing. As an initial matter, Illinois law does not grant a patient a property interest in his medical records; they instead belong to the medical provider. Young v. Murphy, 90 F.3d 1225, 1236 (7th Cir. 1996) ("While Illinois law permits a patient to inspect and copy his records . . . , there is no basis for concluding that this grants a property interest in those records to the patient."); Holtkamp Trucking Co. v. Fletcher, 402 Ill.App.3d 1109, 342 Ill.Dec. 143, 932 N.E.2d 34, 43-44 (2010).
Additionally, this standing theory is squarely foreclosed by our caselaw. In Silha we held "that a plaintiff's claim of injury in fact cannot be based solely on a defendant's gain; it must be based on a plaintiff's loss." 807 F.3d at 174-75. There, students who had taken standardized college admissions tests alleged that the testing agencies had shared their personal information with educational institutions. The students had consented to information sharing, yet the agencies had not disclosed that they had profited from what was really a sale of the students' information. Id. at 171. While the complaint highlighted the agencies' profits, missing was any allegation that the students had "lost anything of value as a result of the alleged misconduct." Id. at 175. Because their claimed injury was "based solely on a gain" to the agencies, we held that the students had not established an injury in fact. Id.
So too here. Dinerstein has not alleged that the University's use of his medical information somehow deprived him of its economic value. And although Dinerstein attempts to distinguish Silha by arguing that unlike him, the students had consented to disclosure, nothing about our resolution of the case turned on consent. Silha's controlling principle—that a plaintiff cannot base an injury in fact solely on the defendant's gain—likewise controls here. In sum, neither of Dinerstein's alleged pecuniary injuries establishes standing to sue under Article III.
2. Breach of Contract
What's left, then, is Dinerstein's argument that a breach of contract is itself a legally cognizable injury in fact. He contends that common-law courts traditionally entertained claims for breach of contract regardless of whether the plaintiff alleged any harm beyond the breach itself. From this he infers that an allegation of a breach of contract is enough, without more, to support Article III standing. In his view, our caselaw supports his interpretation, and the Supreme Court's recent standing cases, namely Spokeo and TransUnion, do not disturb it.
Even if Dinerstein's historical account is correct, we read the Court's recent standing cases differently. In TransUnion the Court confirmed that "an injury in law is not an injury in fact." 141 S. Ct. at 2205. That statement itself might be enough to resolve Dinerstein's "breach-alone" standing theory. Yet to explain why our view diverges from Dinerstein's and that of one of our sister circuits, some additional unpacking is warranted.
As we've already discussed, establishing an injury in fact requires a plaintiff to show that he has suffered a concrete injury—one that is both "real" and "de facto" and that "actually exist[s]." Spokeo, 578 U.S. at 340, 136 S.Ct. 1540. Refining the concreteness requirement, the Court in TransUnion emphasized the distinction between (1) the cause of action giving a plaintiff the right to sue over a defendant's legal infraction and (2) the injury, if any, that he suffered as a result. 141 S. Ct. at 2205. To sue in federal court, a plaintiff must have both; a suitable cause of action cannot save a plaintiff's case if he has suffered no harm. In other words, only a plaintiff who has been "concretely harmed" by the defendant's legal infraction "may sue that private defendant over [it] in federal court." Id.
Applying these concepts here, Dinerstein cannot rest on the University's alleged breach of contract as a discrete de facto injury supporting his standing to sue in federal court. It is at most an injury in law, which we know from TransUnion "is not an injury in fact." Id. (emphasis added). As one scholar put it:
The logic of Spokeo—that standing cannot rest on violations of legal rights that do not result in factual harms—extends to suits alleging breach of contract. After all, contracts simply establish legal rights. By Spokeo's reasoning, a plaintiff should not have standing to sue for breach of contract if the breach does not result in some additional factual harm.F. Andrew Hessick, Standing and Contracts, 89 GEO. WASH. L. REV. 298, 313 (2021). Slightly rephrased, Dinerstein cannot simply allege a bare breach of contract, "divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III." Spokeo, 578 U.S. at 341, 136 S.Ct. 1540. Without an allegation that the purported breach resulted in some concrete harm, we lack the "freewheeling power" to hold the University accountable for its alleged "legal infraction[ ]."Casillas v. Madison Ave. Assocs., Inc., 926 F.3d 329, 332 (7th Cir. 2019).
Yet Dinerstein retorts that Spokeo and TransUnion are irrelevant to the standing question here because neither addressed common-law claims like breach of contract. He reads the cases to answer only whether (and if so, when) Congress may "elevate to the status of legally cognizable" an injury that was "previously inadequate in law." TransUnion, 141 S. Ct. at 2204-05 (quoting Spokeo, 578 U.S. at 341, 136 S.Ct. 1540). To be sure, Spokeo and TransUnion did address and decide those questions. But we read the standing principles expounded in those cases to extend beyond the statutory context. The Court's opinion in TransUnion, for example, set out to answer the broader question: "What makes a harm concrete for purposes of Article III?" Id. at 2204. In answering that question, the Court issued important and broadly applicable statements, including those just mentioned, about the boundaries of the federal judicial power. Fairly interpreted, those statements apply to all asserted injuries, not just statutory violations.
To give a few more examples of TransUnion's capacious language, the Court observed that where a "plaintiff has not suffered any physical, monetary, or cognizable intangible harm traditionally recognized as providing a basis for a lawsuit in American courts," his "lawsuit may not proceed." Id. at 2206. And it defended "the concrete-harm requirement" as "essential to the Constitution's separation of powers." Id. at 2207. Article III does not empower federal courts "to publicly opine on every legal question" or to "exercise general legal oversight . . . of private entities." Id. at 2203. Yet by asking us to weigh in on the University's alleged breach of contract in the absence of any actual harm, Dinerstein invites us to function "not as an Article III court, but as a moot court," and do exactly that. Uzuegbunam v. Preczewski, — U.S. —, 141 S. Ct. 792, 804, 209 L.Ed.2d 94 (2021) (Roberts, C.J., dissenting). We decline the invitation. Taking up such matters "is, by very definition, for a court to act ultra vires." Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 102, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998).
These general standing principles guided the Court as it then considered when Congress may give a real-world injury "actionable legal status." TransUnion, 141 S. Ct. at 2205. And contrary to Dinerstein's view, the Court's framing of this more specific question also supports our reading of its recent caselaw. Rather than ask whether federal courts may depart from established standing doctrine when Congress has attempted to define an injury, in Spokeo and TransUnion the Court explored when a congressionally defined injury might satisfy the existing doctrine. The cases speak, for example, about Congress's lack of authority to "erase Article Ill's standing requirements," Spokeo, 578 U.S. at 339, 136 S.Ct. 1540 (quotation marks omitted), and about our obligation to "independently decide whether a plaintiff has suffered a concrete harm under Article III" notwithstanding Congress's creation of new statutory duties, TransUnion, 141 S. Ct. at 2205. Simply put, Spokeo and TransUnion established "fundamental standing principles," id. at 2207, and those principles control this case.
If Spokeo and TransUnion leave any doubt about whether a breach of contract is itself a concrete injury, Thole v. U.S. Bank N.A., — U.S. —, 140 S. Ct. 1615, 207 L.Ed.2d 85 (2020), resolves it. Thole involved claims for breach of fiduciary duty under ERISA. Two participants in a defined-benefit retirement plan sued the bank contending that it had mismanaged the plan. But crucially, they had sustained no monetary injury from the mismanagement. Id. at 1618. The Supreme Court thus affirmed the Eighth Circuit's dismissal for lack of standing and in so doing rejected the participants' attempted trust-law analogy. "[A] defined-benefit plan," the Court reasoned, "is more in the nature of a contract. The plan participants' benefits are fixed and will not change, regardless of how well or poorly the plan is managed." Id. at 1620 (emphasis added). Because the Court held that the plan participants nonetheless lacked standing to pursue their claims, we understand Thole to imply that an alleged breach of contract, without any corresponding actual harm, does not give rise to an Article III case or controversy.
In fact, the dissent raised this precise point. Thole v. U.S. Bank N.A., — U.S. —, 140 S. Ct. 1615, 1630, 207 L.Ed.2d 85 (2020) (Sotomayor, J., dissenting) (reasoning that the plan participants had standing because a "breach of contract always creates a right of action, even when no financial harm was caused" (quotation marks omitted)). That the majority was not persuaded by this view further supports our conclusion that a breach of contract does not by itself confer standing to sue.
Nor are we persuaded by Dinerstein's argument that the Court's instructions in Spokeo and TransUnion—that we must compare the plaintiff's asserted injury to harms traditionally recognized at common law—resolves the standing question here. As we understand the argument, he contends that because common-law courts allowed a plaintiff to vindicate his contractual rights without a further showing of injury, he need not allege anything aside from the University's bare breach of contract.
True, common-law courts historically heard contract cases and awarded nominal damages even when the breach either "caused no loss" or "the amount of the loss [wa]s not proved." RESTATEMENT (SECOND) OF CONTRACTS § 346(2) (AM. LAW INST. 1981); see also Springer v. Cleveland Clinic Emp. Health Plan Total Care, 900 F.3d 284, 292-93 (6th Cir. 2018) (Thapar, J., concurring) ("[Common-law courts] entertained breach-of-contract claims even when no real loss [could] be prove[n]. Such violations at least deserved nominal damages . . . ." (internal quotation marks omitted)). Yet "[t]he requirements of Art[icle] III are not satisfied merely because a party . . . has couched [his] request for forms of relief historically associated with courts of law in terms that have a familiar ring to those trained in the legal process." Valley Forge Christian Coll. v. Ams. United for Separation of Church & State, Inc., 454 U.S. 464, 471, 102 S.Ct. 752, 70 L.Ed.2d 700 (1982).
More importantly, however, Spokeo and TransUnion put an end to federal courts hearing claims premised on nonexistent injuries—regardless of historical pedigree. And the Court's recently announced "historical-analogue test" does not suggest otherwise. That test asks whether a modern injury bears a "close relationship" to a harm traditionally recognized by common-law courts. TransUnion, 141 S. Ct. at 2204. It does not, however, transform into a concrete factual injury what the common law has historically regarded as a legal injury. Put differently, a historical record is no talisman. It is necessary, but not sufficient, to satisfy the Article III concreteness requirement.
See William Baude, Standing in the Shadow of Congress, 2016 S. CT. REV. 197, 217 ("[I]t is hard to see how nominal damages are fully consistent with the logic of Spokeo. The very premise of nominal damages is that one cannot show any 'actual injury' apart from the violation of the legal right itself." (citing Carey v. Piphus, 435 U.S. 247, 266, 98 S.Ct. 1042, 55 L.Ed.2d 252 (1978))).
Still, because Dinerstein views Spokeo, TransUnion, and Thole as inapposite, he argues that our prior decision in J.P. Morgan Chase Bank, N.A. v. McDonald, 760 F.3d 646 (7th Cir. 2014), binds us. Relevant here, at issue in J.P. Morgan was whether a bank had standing to block an ongoing arbitration proceeding that two investors had initiated after losing approximately a quarter of their initial investment. The contracts governing the investors' accounts included a forum-selection clause that required disputes to be brought in either state or federal court. Id. at 649. Seeking to enforce the forum-selection provision, the bank sued the investors in federal court. After months of litigation, the judge dismissed the bank's claims for lack of standing. Id. at 650.
Reversing the dismissal, we held that the bank had standing to enforce the clause. To form a bilateral contract, each party must "take on one or more legally binding obligations," we explained. Id. "When one party fails to honor its commitments, the other party to the contract suffers a legal injury sufficient to create standing even where that party seems not to have incurred monetary loss or other concrete harm." Id. at 650-51. Because the bank had alleged that the investors had "violated the terms of th[eir] bargain" by selecting an improper dispute-resolution forum, it had established standing to sue. Id. at 651.
Dinerstein understandably seizes on this favorable language, but he omits the discussion that follows it. We went on to explain in J.P. Morgan that the bank had "a very real financial interest in the arbitration" because it was statutorily and contractually obligated to "foot the bill" for the resulting costs. Id. Given this independent financial interest, the standing question was not merely "one of abstract principle"; it was yet another reason why the bank had standing to sue. Id.
The concrete harms present in J.P. Morgan—being hauled into an improper forum and financing the resulting costs—distinguish it from this case. Moreover, while those harms prevent us from needing to revisit J.P. Morgan, we note that some language in the opinion is in tension with the Supreme Court's recent decisions in Spokeo and TransUnion. No longer is "a legal injury sufficient to create standing." J.P. Morgan, 760 F.3d at 651. "[U]nder Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed" by a defendant may sue in federal court. TransUnion, 141 S. Ct. at 2205. Any portion of our opinion in J.P. Morgan that suggests otherwise cannot control here.
Finally, we recognize that some tension also exists between our analysis here and that of a few of our sister circuits. There is no direct conflict, however. For starters, many of the out-of-circuit decisions pointing in the other direction predate TransUnion, a watershed decision on the standing doctrine. See, e.g., Mitchell v. Blue Cross Blue Shield, 953 F.3d 529, 536 (8th Cir. 2020); Springer, 900 F.3d at 287; Katz v. Pershing, LLC, 672 F.3d 64, 72 (1st Cir. 2012). Of the circuits to consider the issue post-TransUnion, we understand one to agree with our position, Perry v. Newsom, 18 F.4th 622, 632 (9th Cir. 2021) ("An analogy to a traditionally recognized cause of action does not relieve a complainant of its burden to demonstrate an injury."); one to leave it unresolved, Glennborough Homeowners Ass'n v. U.S. Postal Serv., 21 F.4th 410, 415-16 (6th Cir. 2021) ("We need not resolve these thorny questions today . . . ."); and one to come out the other way, Denning v. Bond Pharmacy, Inc., 50 F.4th 445, 451 (5th Cir. 2022) ("[A] breach of contract is a sufficient injury for standing purposes."). But the Fifth Circuit's opinion in Denning did not engage with the logic of Spokeo and TransUnion and rested in part on its own precedent. We therefore do not understand the Fifth Circuit's decision to conflict with our own, nor are we inclined to adopt its approach. As we read Thole, TransUnion, and Spokeo, a breach of contract alone—without any actual harm—is purely an injury in law, not an injury in fact. And it therefore falls short of the Article III requirements for a suit in federal court.
C. Remaining Claims
We need not spend much time addressing the tortious-interference and consumer-fraud claims. Both rest on the same allegations of a privacy, pecuniary, or contractual injury that we've already examined and deemed insufficient to confer standing.
Put simply, Dinerstein seeks to invoke the power of the federal courts to challenge the lawfulness of an event that caused him no harm. But federal courts do not offer "judicial determination[s] that the plaintiffs' interpretation of the law is correct"; we resolve cases and controversies. Uzuegbunam, 141 S. Ct. at 804 (Roberts, C.J., dissenting). Because Dinerstein has not alleged a plausible, concrete, and actual or imminent injury to support his standing to sue, no such case or controversy exists here. We accordingly modify the judgment to reflect a jurisdictional dismissal for lack of standing. As modified, the judgment is
AFFIRMED.