Maglio v. Advocate Health and Hospitals Corporation , 2015 IL App (2d) 140782 ( 2015 )


Menu:
  •                              
    2015 IL App (2d) 140782
                             Nos. 2-14-0782 & 2-14-0998 cons.
    Opinion filed August 6, 2015
    ______________________________________________________________________________
    IN THE
    APPELLATE COURT OF ILLINOIS
    SECOND DISTRICT
    ______________________________________________________________________________
    MATIAS MAGLIO, Individually and as     ) Appeal from the Circuit Court
    Father and Next Friend of Macailee Maglio,
    ) of Kane County.
    a Minor, and on Behalf of All Others Similarly
    )
    Situated, and ALEXANDER GIL, Individually
    )
    and on Behalf of All Others Similarly Situated,
    )
    )
    Plaintiffs-Appellants,           )
    )
    v.                                     ) No. 13-L-358
    )
    ADVOCATE HEALTH AND HOSPITALS          )
    CORPORATION, Individually and d/b/a    )
    Advocate Medical Group,                ) Honorable
    ) James R. Murphy,
    Defendants-Appellees.            ) Judge, Presiding.
    ______________________________________________________________________________
    VERONICA VIDES, Individually and as               )   Appeal from the Circuit Court
    Mother and Next Friend of I.X.A. and              )   of Lake County.
    B.K.A., Minors, PETER SINK, PAULA                 )
    WISNIOWICZ, GREGG WISNIOWICZ,                     )
    SHARI SLAVIN, ARTHUR COHEN,                       )
    DAVID COHEN, JENNIFER COHEN,                      )
    MARIANNA COHEN, AUDREY                            )
    FRIEDLAND, JULIE MARDER, ERIC                     )
    MARDER, AMY FRIEDLAND, LORI                       )
    FRIEDLAND, SCOTT FRIEDLAND,                       )
    MICHAEL FRIEDLAND, RENEE ROUSE,                   )
    ROBIN FIELDS, MITCHEL A. FIELDS,                  )
    Individually and on Behalf of All others          )
    Similarly Situated,                               )
    )
    Plaintiffs-Appellants,                     )
    )
    
    2015 IL App (2d) 140782
    v.                                     ) No. 13-CH-2701
    )
    ADVOCATE HEALTH AND HOSPITALS          )
    CORPORATION, d/b/a Advocate Medical    )
    Group,                                 ) Honorable
    ) Mitchell L. Hoffman,
    Defendant-Appellee.             ) Judge, Presiding.
    ______________________________________________________________________________
    JUSTICE JORGENSEN delivered the judgment of the court, with opinion.
    Presiding Justice Schostok and Justice Birkett concurred in the judgment and opinion.
    OPINION
    ¶1     In these consolidated cases, plaintiffs filed putative class actions against defendant,
    Advocate Health and Hospitals Corporation, individually and d/b/a Advocate Medical Group
    (Advocate), raising claims of negligence, violations of the Personal Information Protection Act
    (Protection Act) (815 ILCS 530/1 et seq. (West 2014)), the Consumer Fraud and Deceptive
    Business Practices Act (Fraud Act) (815 ILCS 505/1 et seq. (West 2014)), and invasion of
    privacy, after four computers containing patient information were stolen from Advocate’s
    offices. Plaintiffs did not allege that their personal information was used in any unauthorized
    manner as a result of the burglary, but they claimed that they face an increased risk of identity
    theft and/or identity fraud. In each case Advocate moved to dismiss under section 2-619.1 of the
    Code of Civil Procedure (Code) (735 ILCS 5/2-619.1 (West 2014)) and the trial court dismissed
    plaintiffs’ complaint, with prejudice, pursuant to: (1) section 2-619(a)(9) of the Code, finding
    that the disclosure of confidential information did not constitute an injury-in-fact sufficient to
    confer standing to pursue an action against Advocate; and, alternatively, (2) section 2-615 of the
    Code, finding that the complaint failed to state a claim upon which relief could be granted.
    Plaintiffs appeal. We affirm.
    ¶2                                     I. BACKGROUND
    -2-
    
    2015 IL App (2d) 140782
    ¶3     Advocate is a network of affiliated doctors and hospitals that treat patients throughout the
    state. On July 15, 2013, burglars stole from Advocate’s administrative building in Park Ridge
    four password-protected computers that contained certain information relating to about 4 million
    patients. Advocate subsequently notified the patients about the incident, set up a call center to
    answer their questions, and offered them one year of free credit-monitoring services, including
    identity theft resolution assistance and identity theft insurance.
    ¶4     On September 25, 2013, several plaintiffs sued Advocate in the circuit court of Lake
    County (appeal No. 2-14-0998). On October 24, 2013, several plaintiffs sued Advocate in the
    circuit court of Kane County (appeal No. 2-14-0782). Both actions were brought as putative
    class actions.
    ¶5     The complaints asserted substantially similar allegations. Plaintiffs, who were patients or
    former patients of Advocate, alleged that the personal information contained in the four stolen
    computers, which have not been located, included their names, addresses, dates of birth, social
    security numbers, health insurance data, Medicare and Medicaid data, medical diagnoses,
    diagnosis codes, and medical record numbers. Advocate learned of the burglary on July 15,
    2013, and notified plaintiffs on August 23, 2013. Plaintiffs alleged that the theft was caused by
    Advocate’s failure to meet its obligation to abide by the best practices and industry standards
    concerning the security of personal information and the computers associated therewith. They
    also alleged that Advocate failed to timely notify them of the data breach and that Advocate’s
    computers were not secure or encrypted. Thus, they further alleged, Advocate facilitated and
    allowed for the unlawful disclosure of patients’ private and confidential health information.
    (Plaintiffs did not allege that anyone had improperly accessed or used the information that was
    -3-
    
    2015 IL App (2d) 140782
    on the stolen computers or that they have suffered identity theft and/or identity fraud as a result
    of the burglary.)
    ¶6     Specifically, in their negligence counts, plaintiffs alleged that Advocate had a duty,
    pursuant to federal and state law, including the Protection Act and the Fraud Act, to securely
    maintain and to not disclose or disseminate, without patient authorization, the personal
    information at issue. They alleged that Advocate breached this duty when it used unsecured,
    unencrypted computers to store such information and thus permitted the unlawful and
    unauthorized disclosure of the information. Plaintiffs asserted that, as a result of Advocate’s
    breach, they suffered personal and pecuniary damages.
    ¶7     In their Protection Act counts, plaintiffs alleged that Advocate was a “data collector”
    (815 ILCS 530/5 (West 2014) (defined as an “entity that, for any purpose, handles, collects,
    disseminates, or otherwise deals with nonpublic personal information”)) and did not timely
    notify them of the breach (815 ILCS 530/10(a) (West 2014) (notice to be given “in the most
    expedient time possible and without unreasonable delay, consistent with any measures necessary
    to determine the scope of the breach and restore the reasonable integrity, security, and
    confidentiality of the data system”)). Plaintiffs sought an injunction to require Advocate to
    comply with the statute.
    ¶8     In their counts pursuant to the Fraud Act, plaintiffs alleged that Advocate committed
    unfair trade practices by failing to maintain reasonable procedures to protect against
    unauthorized access to plaintiffs’ personal information, that Advocate violated public policy
    because class members had no choice but to submit their information, that Advocate intended
    that members rely on its unfair practices, and that the practices were willful, wanton, continuing,
    -4-
    
    2015 IL App (2d) 140782
    and widespread. Also, plaintiffs noted that a Protection Act violation constituted an unlawful
    practice under the Fraud Act. 815 ILCS 530/20 (West 2014).
    ¶9      In their counts alleging invasion of privacy, plaintiffs asserted that Advocate’s
    impermissible and unauthorized disclosure and dissemination constituted an unauthorized
    intrusion into plaintiffs’ privacy and seclusion, which was highly offensive to them and would be
    so to a reasonable person. Plaintiffs also alleged that Advocate’s intrusion was an invasion of
    private matters, causing them anguish and suffering. Additionally, the Lake County plaintiffs
    included a count asserting intentional infliction of emotional distress. All plaintiffs sought class
    certification, damages, attorney fees, costs, statutory interest, penalties, and injunctive and/or
    declaratory relief.
    ¶ 10    Advocate moved to dismiss plaintiffs’ complaints, arguing that: (1) plaintiffs lacked
    standing because they did not suffer the requisite injury-in-fact (735 ILCS 5/2-619(a)(9) (West
    2014)), where their claimed injury—merely that the information was stolen—was insufficient
    and any claim that plaintiffs face an increased risk of identity theft and identity fraud was
    speculative; and (2) each count failed to state a claim upon which relief could be granted (735
    ILCS 5/2-615 (West 2014)).
    ¶ 11    On May 27, 2014, the Lake County circuit court dismissed, with prejudice, plaintiffs’
    complaint. The court found that allegations of possible future injury were insufficient to confer
    standing.   Plaintiffs did not allege facts that “would plausibly establish an ‘imminent’ or
    ‘certainly impending’ risk that they will be victimized.” The court further noted that “the harm
    that Plaintiffs fear is contingent on a chain of attenuated hypothetical events and actions by third
    parties independent of the defendant,” noting that these included: whether their data was actually
    taken after the burglary, whether it was subsequently sold or otherwise transferred, whether
    -5-
    
    2015 IL App (2d) 140782
    anyone attempted to use it, and whether they succeeded. The increased risk that plaintiffs will be
    identity theft victims at some indeterminate point in the future, the court determined, did not
    constitute an injury sufficient to confer standing, where the occurrence of such future injury
    rested on the criminal actions of independent decision-makers and where the complaint lacked
    sufficient factual allegations that such future injury was imminent or certainly impending.
    ¶ 12   Addressing the Protection Act and the Fraud Act claims, and even assuming that
    Advocate violated the statutes by inadequately notifying plaintiffs, the court found that the
    violations, without any actual damages due to the data breach, were insufficient to establish
    standing. The time and expenses that plaintiffs incurred to mitigate the risk of identity theft were
    also insufficient to confer standing, because they involved a response to a speculative threat.
    Next, addressing plaintiffs’ allegations concerning anxiety and emotional distress, the court
    found that these, too, were insufficient to establish standing, as they were not based on an
    imminent threat; rather, they alleged only speculative future criminal acts. Also, the court found
    that plaintiffs’ loss-of-privacy allegations were insufficient to establish standing, where they did
    not plead that the information was disclosed.
    ¶ 13   Next, the trial court addressed Advocate’s section 2-615 argument, finding in the
    alternative that plaintiffs’ causes of action did not state claims upon which relief could be
    granted. As to negligence, the court determined that plaintiffs failed to allege a compensable
    present injury. Addressing the Protection Act and the Fraud Act claims, the court found that
    plaintiffs did not allege actual damages arising from statutory violations and could not rely on
    speculative future or presumed damages. As to the invasion-of-privacy-by-public-disclosure-of-
    private-facts claim, the court found that plaintiffs failed to allege that Advocate disclosed and
    disseminated plaintiffs’ private information; further, even if they did so allege, they failed to
    -6-
    
    2015 IL App (2d) 140782
    allege publicity. Next, as to intentional infliction of emotional distress, the court determined that
    the allegations were insufficient to satisfy the extreme-and-outrageous and causation-of-severe-
    emotional-distress elements of the cause of action. The complaint, it found, simply set forth
    conclusory allegations.
    ¶ 14   Finally, the court addressed Advocate’s argument that the economic-loss doctrine, which
    bars recovery in tort actions for solely economic losses, barred plaintiffs’ tort claims. The court
    agreed with Advocate, noting that the plaintiffs did not respond to this argument and that case
    law instructed that the alleged injuries were economic losses (except for emotional distress,
    which the court found not to be viable where it was based on speculative harm) and, therefore,
    were barred because plaintiffs did not allege that they suffered personal injury or property
    damage and because no exception applied.
    ¶ 15   On July 10, 2014, the Kane County circuit court dismissed, with prejudice, plaintiffs’
    complaint. It determined that plaintiffs did not sufficiently allege standing, where they made no
    allegations of an actual or certainly impending identity theft. As to the damages element of the
    negligence and the Fraud Act claims, the trial court found that dismissal was warranted because
    plaintiffs alleged only an increased risk of possible future identity theft, rather than any present
    harm. As to the invasion-of-privacy claim, the court similarly found it lacking, where, at most,
    Advocate was negligent and where plaintiffs had voluntarily given Advocate the information at
    issue. As to the public-disclosure-of-private-facts theory, the court found that the allegations did
    not support two elements of such a claim: that Advocate had publicized the information or that
    the information was publicized at all. Finally, addressing the economic-loss doctrine, the court
    found that plaintiffs could not recover for purely economic losses under tort theories and that
    none of the exceptions applied.
    -7-
    
    2015 IL App (2d) 140782
    ¶ 16   Plaintiffs appeal.
    ¶ 17                                      II. ANALYSIS
    ¶ 18   On appeal, plaintiffs argue that the trial courts’ orders dismissing their complaints, for
    both lack of standing and failure to state claims, were erroneous. For the following reasons, we
    conclude that plaintiffs did not have standing to bring their suits. Accordingly, we need not
    reach the alternative bases upon which the trial courts dismissed the complaints.
    ¶ 19   Advocate’s motions to dismiss were brought pursuant to section 2-619.1 of the Code,
    which allows a party to move for dismissal under both sections 2-615 and 2-619. 735 ILCS 5/2-
    619.1 (West 2014).     A section 2-615 motion to dismiss attacks the legal sufficiency of a
    complaint. Carr v. Koch, 
    2012 IL 113414
    , ¶ 27. In ruling on such a motion, a court must accept
    as true all well-pleaded facts in the complaint, as well as any reasonable inferences that may
    arise from them. Bonhomme v. St. James, 
    2012 IL 112393
    , ¶ 34. The critical inquiry is whether
    the allegations in the complaint, when construed in the light most favorable to the plaintiff, are
    sufficient to establish a cause of action upon which relief may be granted. 
    Id. A cause
    of action
    should not be dismissed under section 2-615 unless it is clearly apparent from the pleadings that
    no set of facts can be proven that would entitle the plaintiff to recover. Khan v. Deutsche Bank
    AG, 
    2012 IL 112219
    , ¶ 47.
    ¶ 20   A motion brought pursuant to section 2-619 admits the sufficiency of the complaint, but
    asserts an affirmative defense or other matter that avoids or defeats the claim. 
    Id. ¶ 18.
    In ruling
    on a section 2-619 motion to dismiss, the court must interpret the pleadings and supporting
    materials in the light most favorable to the nonmoving party. Van Meter v. Darien Park District,
    
    207 Ill. 2d 359
    , 367-68 (2003) (quoting In re Chicago Flood Litigation, 
    176 Ill. 2d 179
    , 189
    (1997)). Lack of standing is an affirmative matter that is properly raised under section 2-
    -8-
    
    2015 IL App (2d) 140782
    619(a)(9). Glisson v. City of Marion, 
    188 Ill. 2d 211
    , 220 (1999). Where a plaintiff lacks
    standing, the proceedings must be dismissed because the lack of standing negates the plaintiff’s
    cause of action. Wexler v. Wirtz Corp., 
    211 Ill. 2d 18
    , 22 (2004). We review de novo a dismissal
    under either section 2-615 or section 2-619. Carr, 
    2012 IL 113414
    , ¶ 27.
    ¶ 21      The doctrine of standing ensures that issues are raised only by those parties with a real
    interest in the outcome of the controversy. 
    Wexler, 211 Ill. 2d at 23
    . Although determining
    whether a plaintiff has standing depends on the allegations in the complaint (Barber v. City of
    Springfield, 
    406 Ill. App. 3d 1099
    , 1101 (2011)), the plaintiff need not allege facts in the
    complaint that establish standing (Chicago Teachers Union, Local 1 v. Board of Education, 
    189 Ill. 2d 200
    , 206 (2000)). Rather, a plaintiff’s lack of standing is an affirmative defense and, as
    such, must be pleaded and proven by the defendant. Lebron v. Gottlieb Memorial Hospital, 
    237 Ill. 2d 217
    , 252 (2010). Further, in assessing standing in a class action, which plaintiffs seek
    these cases to be, we focus on the named plaintiffs’ allegations, not the general class they purport
    to represent. I.C.S. Illinois, Inc. v. Waste Management of Illinois, Inc., 
    403 Ill. App. 3d 211
    , 221
    (2010).
    ¶ 22      Standing requires some injury-in-fact to a legally cognizable interest. Greer v. Illinois
    Housing Development Authority, 
    122 Ill. 2d 462
    , 492-93 (1988) (diminution in value of property
    is an injury-in-fact to a legally cognizable interest). To establish standing, the claimed injury can
    be actual or threatened and it must be: (1) distinct and palpable; (2) fairly traceable to the
    defendant’s actions; and (3) substantially likely to be prevented or redressed by the grant of the
    requested relief. Carr, 
    2012 IL 113414
    , ¶ 28. These cases focus on the first element.
    ¶ 23      Turning first to Illinois case law, in Chicago Teachers Union, Local 1, certain high
    school physical education teachers and others challenged the constitutionality of a school code
    -9-
    
    2015 IL App (2d) 140782
    provision that allowed school districts to petition the State Board of Education for a waiver from
    statutory mandates related to the daily requirement for physical education. The supreme court
    held that the teachers did not have standing to challenge the statute, rejecting the teachers’
    allegations that they would be injured by lost employment opportunities if the waiver were
    granted. Chicago Teachers Union, Local 
    1, 189 Ill. 2d at 208
    . The court noted that any adverse
    consequences, such as diminished need for physical education teachers, was “purely
    speculative,” as such classes would be available as electives if a waiver were granted, the scope
    of any reduction was “purely conjectural,” and the teachers, who were tenured, would still have
    the opportunity to teach ninth and tenth grade students, to whom the waiver would not apply. 
    Id. at 207-08.
      The court concluded: “the teachers cannot be said to have sustained or be in
    immediate danger of sustaining a direct injury as a result of enforcement of the challenged
    statute that is distinct and palpable and substantially likely to be prevented or redressed by the
    grant of the requested relief.” (Emphasis added.) 
    Id. at 208.
    ¶ 24   Here, plaintiffs’ allegations of injury are clearly speculative, and therefore plaintiffs lack
    standing to bring suit. Their claims that they face an increased risk of, for example, identity theft
    are purely speculative and conclusory, as no such identity theft has occurred to any of the
    plaintiffs. Thus, their allegations fail to show a distinct and palpable injury.
    ¶ 25   Federal standing principles are similar to those in Illinois, and the case law is instructive.
    In a federal court, to show standing under article III of the United States Constitution, a plaintiff
    must establish the existence of an injury that is: (1) concrete, particularized, and actual or
    imminent; (2) fairly traceable to the challenged action; and (3) redressable by a favorable ruling.
    Clapper v. Amnesty International USA, 568 U.S. ___, ___, 
    133 S. Ct. 1138
    , 1147 (2013). As to
    the first prong, an “allegation of future injury may suffice if the threatened injury is ‘certainly
    - 10 -
    
    2015 IL App (2d) 140782
    impending,’ or there is a ‘ “substantial risk” ’ that the harm will occur.” (Emphases added.)
    Susan B. Anthony List v. Driehaus, 573 U.S. ___, ___, 
    134 S. Ct. 2334
    , 2341 (2014) (quoting
    Clapper, 568 U.S. at ___, ___ 
    n.5, 133 S. Ct. at 1147
    , 1150 n.5). The Clapper Court noted,
    however, that “ ‘[a]llegations of possible future injury’ are not sufficient.” (Emphasis added.)
    Clapper, 568 U.S. at ___, 133 S. Ct. at 1147 (quoting Whitmore v. Arkansas, 
    495 U.S. 149
    , 158
    (1990)). It also rejected the objectively-reasonable-likelihood standard, as inconsistent with the
    requirement that the threatened injury be certainly impending to constitute an injury-in-fact; a
    theory that relies on a highly attenuated chain of events, it noted, does not meet the certainly-
    impending standard. Id. at ___, 133 S. Ct. at 1147-48; see, e.g., Peters v. St. Joseph Services
    Corp., No. 4:14-CV-2872, 
    2015 WL 589561
    , at *7 (S.D. Tex. Feb. 11, 2015) (putative class
    action against hospital system following data breach dismissed, where the plaintiff did not have
    standing to bring her federal claims; the heightened risk of future identity theft/fraud posed by
    the data breach did not confer article III standing on persons whose information might have been
    accessed).
    ¶ 26   Clapper and Susan B. Anthony are the Supreme Court’s most recent pronouncements on
    standing that address the injury-in-fact requirement. However, plaintiffs rely on Pisciotta v. Old
    National Bankcorp., 
    499 F.3d 629
    (7th Cir. 2007), a pre-Clapper decision, to argue that a mere
    increased risk of harm is sufficient to serve as the basis for an injury-in-fact and confer standing.
    
    Id. at 634
    (noting that “the injury-in-fact requirement can be satisfied by a threat of future harm
    or by an act which harms the plaintiff only by increasing the risk of future harm that the plaintiff
    would have otherwise faced, absent the defendant’s actions” (emphasis added)). We agree with
    the courts that have held that Clapper “compels rejection of [the plaintiffs’] claim that an
    increased risk of identity theft is sufficient to satisfy the injury-in-fact requirement for standing.”
    - 11 -
    
    2015 IL App (2d) 140782
    Strautins v. Trustwave Holdings, Inc., 
    27 F. Supp. 3d 871
    , 876 (N.D. Ill. 2014); see also In re
    Barnes & Noble Pin Pad Litigation, No. 12-CV-8617, Sept. 3, 
    2013 WL 4759588
    , at *3 (N.D.
    Ill. 2013); Peters, 
    2015 WL 589561
    , at *7. 1 Thus, we do not view Pisciotta, which would be
    merely persuasive authority at best (Westlake Financial Group, Inc. v. CDH-Delnor Health
    System, 
    2015 IL App (2d) 140589
    , ¶ 43), as instructive. 2 As another court has noted, “an
    increased risk or credible threat of impending harm is plainly different from certainly impending
    harm, and certainly impending harm is what the Constitution and Clapper require.” (Emphases
    in original.) In re: Science Applications International Corp. (SAIC) Backup Tape Data Theft
    Litigation, 
    45 F. Supp. 3d 14
    , 28 (D.D.C. 2014). As plaintiffs here have not alleged that their
    personal information has actually been used or that they have been victims of identity theft or
    1
    There appears to be an intra-circuit split in the Seventh Circuit, with two courts ruling
    that Clapper abrogated Pisciotta and one court ruling otherwise. Compare Strautins, 
    27 F. Supp. 3d
    at 879, and Barnes & Noble, 
    2013 WL 4759588
    , at *3, with Moyer v. Michaels Stores, Inc.,
    No. 14C561, 
    2014 WL 3511500
    , at *5 (N.D. Ill. July 14, 2014) (disagreeing that Clapper
    overruled Pisciotta).
    2
    It has also been criticized as poorly reasoned. Peters, 
    2015 WL 589561
    , at *6 n.9
    (noting that medical-device, toxic-substance, and environmental-injury cases, to which Pisciotta
    drew analogies, were separate and distinguishable from data-breach cases; in environmental-
    injury cases, the standing question was not whether damage had occurred, but rather how it
    would manifest; further, monetary awards would likely restore data-breach victims to their
    original position, whereas they might not adequately remedy the harms suffered by
    environmental-injury victims).
    - 12 -
    
    2015 IL App (2d) 140782
    fraud, the arguably increased risk of such acts as a result of Advocate’s data breach is
    insufficient to confer standing as that concept is applied in federal cases.
    ¶ 27   Plaintiffs further argue that the medical information at issue here warrants a finding that
    the harm is implicit. They urge that an actual injury occurs when a medical professional fails to
    keep a patient’s medical information private.        Such information is, they assert, inherently
    personal and particularized to the individual. We reject plaintiffs’ argument. They rely on
    Tabata v. Charleston Area Medical Center, Inc., 
    759 S.E.2d 459
    (W. Va. 2014), where the court
    held that the petitioners, whose medical records were accidentally placed on the Internet, had
    standing under state law to bring causes of action for breach of confidentiality and invasion of
    privacy. 
    Id. at 517-18.
    Tabata is distinguishable because the data in that case was actually
    published on the internet for six months (id. at 515 n.1), whereas, here, there has been no known
    public disclosure or identity theft or fraud with respect to plaintiffs’ data in the nearly two years
    since the burglary.
    ¶ 28   Plaintiffs also argue that their claims rest not on a speculative chain of possibilities, but
    rather on actions that already occurred: the computers were stolen; unencrypted information is
    accessible and recoverable by anyone having access to the computers; 3 the data has significant
    monetary value; there is a known market for the sale of the data; and “it can be deduced that the
    data is being used to the detriment of the” victims. They also point to a similar lawsuit filed in
    federal court, also involving victims of the Advocate burglary, where two of the plaintiffs
    documented actual exposure to identity theft and fraud. Tierney v. Advocate Health & Hospitals
    Corp., No. 13CV6237, 
    2014 WL 5783333
    , at *2 (N.D. Ill. Sept. 4, 2014). With respect to the
    two plaintiffs who alleged that they were injured, where each was notified of fraudulent activity,
    3
    Advocate alleged in its filings that the computers were password-protected.
    - 13 -
    
    2015 IL App (2d) 140782
    such as attempted access to bank accounts and opened cell phone accounts, the court found that
    they sufficiently alleged standing. However, four of the plaintiffs alleged only a speculative fear
    that the information could have been bought and sold and placed them at risk for identity theft,
    identity fraud, and medical fraud, and the court concluded that “[w]ithout any allegations to
    support their mere conclusion of imminent harm, they fail to establish standing.”
    ¶ 29   We reject plaintiffs’ arguments and note again that their allegations are merely
    speculative. They alleged in their complaints that the records of 4 million patients were affected
    by the Advocate burglary. The fact that two plaintiffs to date (out of those 4 million) have
    received notification of fraudulent activity, i.e., have suffered actual injury arising from
    Advocate’s alleged wrongful acts, does not show that plaintiffs here face imminent, certainly
    impending, or a substantial risk of harm as a result of the burglary, where no such activity has
    occurred with respect to their personal data. Plaintiffs here are like the four plaintiffs in Tierney
    who were unable to allege actual injury and who the district court found had no standing.
    ¶ 30   We also reject plaintiffs’ claims that they sufficiently alleged “appreciable emotional
    injury” as a result of the burglary. Plaintiffs again point to the two Tierney plaintiffs who
    received notification of fraudulent activity. They argue that it can be deduced that their data is
    being viewed and used in a malicious way, causing them anxiety and emotional distress. Again,
    given the speculative and conclusory nature of their allegations and the lack of imminent,
    certainly impending, or a substantial risk of harm, this argument fails. See, e.g., Crisafulli v.
    Ameritas Life Insurance Co., No. 13-5937, 
    2015 WL 1969176
    , at *4 (D.N.J. 2015) (noting that
    courts “across the country have rejected ‘emotional distress’ as a basis for standing” (citing
    
    SAIC, 45 F. Supp. 3d at 26
    (the plaintiffs “do not have standing based on risk alone, even if their
    fears are rational”))); Barnes & Noble, 
    2013 WL 4759588
    , at *5 (anxiety insufficient to establish
    - 14 -
    
    2015 IL App (2d) 140782
    standing, where there was no imminent threat of the plaintiff’s information being used in a
    malicious way).
    ¶ 31   Finally, plaintiffs argue that their invasion-of-privacy claims should not have been
    dismissed for lack of standing. They contend that the release of the information is sufficiently
    egregious without their having to show that it was accessed, because the privacy of their health
    care has been compromised.        We reject this argument, because case law requires actual
    disclosure to a third party and plaintiffs have made no such allegations. See SAIC, 
    45 F. Supp. 3d
    at 28-29 (citing cases and holding that the plaintiffs, who did not contend that their personal
    information was viewed or exposed in any way that would facilitate easy imminent access, did
    not have standing based on invasion of privacy; rather, they were “out of luck”); Barnes &
    Noble, 
    2013 WL 4759588
    , at *4 (lack of facts alleging disclosure fatal to privacy argument); see
    also Ainsworth v. Century Supply Co., 
    295 Ill. App. 3d 644
    , 648 (1998) (public disclosure is an
    element of invasion-of-privacy tort).
    ¶ 32   Because we affirm the trial courts’ dismissals under section 2-619(a)(9) based on
    plaintiffs’ lack of standing, we need not reach Advocate’s alternative arguments under section 2-
    615.
    ¶ 33                                    III. CONCLUSION
    ¶ 34   For the reasons stated, the judgment of the circuit court of Kane County is affirmed, as is
    the judgment of the circuit court of Lake County.
    ¶ 35   Affirmed.
    - 15 -