Background
After an unauthorized third party accessed files in medical-transcription vendor Perry Johnson & Associates’ systems, plaintiffs Terry Kimber and Veronica Martin brought a putative class action against the vendor and Cook County Health and Hospitals System. The files may have contained patient names and combinations of birth dates, addresses, medical and encounter information, and service dates; they also included Social Security numbers for about 2,600 people.
Plaintiffs alleged an increased risk of identity and medical identity theft, diminished value of their personal information, privacy harms, mitigation costs, and overpayment for healthcare services. Martin also alleged increased spam calls, texts, and emails. Neither plaintiff alleged actual fraudulent or unauthorized use of their information. The circuit court dismissed the action with prejudice for lack of standing.
The Court’s Holding
The appellate court affirmed. An increased risk of future identity theft, without alleged attempted or actual misuse of the compromised data fairly traceable to the breach, was too speculative to constitute an imminent or substantial injury for Illinois standing purposes.
Martin’s spam allegations did not establish standing because the complaint did not plausibly connect the spam to the breach. It did not allege that her contact information was exposed, that the spam used breached information, or other facts showing causation beyond timing.
The court also held that unspecified mitigation costs could not create standing where the underlying future harm was speculative. It rejected the claimed diminished value of personal information as a cognizable injury and did not reach the overpayment theory because plaintiffs forfeited it on appeal.
Key Takeaways
- In Illinois data-breach cases, a generalized heightened risk of identity theft is insufficient without a concrete, imminent threat.
- Allegations of spam require facts tying the communications to the particular breach; temporal proximity alone is not enough.
- Mitigation expenses do not establish standing when incurred in response to speculative future harm.
Why It Matters
The decision applies the Illinois Supreme Court’s recent standing analysis in data-breach litigation and treats traceable misuse of compromised information as critical. Plaintiffs alleging only exposure of sensitive information, without fraud or other adequately connected misuse, may not proceed past a standing challenge.