Maglio v. Advocate Health and Hospitals Corporation
40 N.E.3d 746
Ill. App. Ct.2015Background
- Advocate Health (Advocate) had four password-protected computers stolen from an administrative office; the devices contained personal and medical data for ~4 million patients. Advocate notified patients, opened a call center, and offered one year of credit monitoring.
- Multiple putative class actions filed in Lake and Kane Counties alleged negligence, violations of the Illinois Personal Information Protection Act and Consumer Fraud Act, invasion of privacy, and (in Lake County) intentional infliction of emotional distress; plaintiffs did not allege their data had been misused.
- Plaintiffs claimed increased risk of identity theft, emotional distress, and statutory claims for inadequate data security and delayed notice; they sought damages, injunctive relief, and class certification.
- Advocate moved to dismiss under 735 ILCS 5/2-619.1, asserting lack of standing (section 2-619(a)(9)) and failure to state claims (section 2-615) and invoking the economic-loss doctrine.
- Both trial courts dismissed the complaints with prejudice for lack of standing, finding plaintiffs’ alleged harms (increased risk of future identity theft, anxiety, statutory violations without actual damages, and loss of privacy absent disclosure) were speculative and not “certainly impending.”
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing — injury-in-fact from a data breach | Increased risk of identity theft and compromised medical privacy constitute a cognizable injury | Risk is speculative; no actual misuse of plaintiffs’ data, so no present or certainly- impending injury | Plaintiffs lack standing; speculative future harms insufficient |
| Statutory claims (Protection Act & Consumer Fraud Act) — damages/relief after breach | Violation of duties and delayed notice confer statutory injury and injunctive relief even absent realized misuse | Statutory violations without actual damages do not create present injury; mitigation costs speculative | Dismissed for lack of standing; courts need actual or imminent injury to proceed |
| Invasion of privacy — public disclosure theory | Theft of records itself compromises privacy and is actionable without proof of public dissemination | Public-disclosure tort requires actual disclosure/publicity to third parties | Dismissed: plaintiffs did not allege disclosure/publicity, so no standing on this ground |
| Emotional distress / mitigation costs as bases for standing | Anxiety and mitigation efforts (time/cost) are concrete harms caused by the breach | Emotional harms tied to speculative future misuse are not sufficiently imminent; mitigation costs respond to hypothetical threat | Dismissed: emotional distress and mitigation expenses, without imminent risk or actual misuse, do not establish standing |
Key Cases Cited
- Clapper v. Amnesty Int'l USA, 133 S. Ct. 1138 (Sup. Ct. 2013) (federal standing requires injury that is concrete and actual or certainly impending; speculative future harms insufficient)
- Susan B. Anthony List v. Driehaus, 134 S. Ct. 2334 (Sup. Ct. 2014) (reiterating that threatened injury must be certainly impending or present a substantial risk)
- Pisciotta v. Old Nat'l Bancorp., 499 F.3d 629 (7th Cir. 2007) (pre-Clapper: held increased risk of future harm can satisfy injury-in-fact in certain contexts)
- Chicago Teachers Union, Local 1 v. Board of Education, 189 Ill. 2d 200 (Ill. 2000) (Illinois standing requires distinct, palpable injury and not merely speculative future harm)
- Wexler v. Wirtz Corp., 211 Ill. 2d 18 (Ill. 2004) (lack of standing is an affirmative defense that defeats the plaintiff’s cause of action)