Opinion
No. 2-14-0782 No. 2-14-0998 cons.
06-02-2015
MATIAS MAGLIO, individually and as father and next friend of MACAILEE MAGLIO, and ALEXANDER GIL, individually and each on behalf of all others similarly situated, Plaintiffs-Appellants, v. ADVOCATE HEALTH AND HOSPITALS CORPORATION and ADVOCATE HEALTH AND HOSPITALS CORPORATION d/b/a ADVOCATE MEDICAL GROUP, Defendants-Appellees. VERONICA VIDES, individually and as mother and next friend of IXA and BKA, PETER SINK, PAULA WISNIOWICZ, GREGG WISNIOWICZ, SHARI SLAVIN, ARTHUR COHEN, MARIANNA COHEN, AUDREY FRIEDLAND, JULIE MARDER, ERIC MARDER, AMY FRIEDLAND, LORI FRIEDLAND, SCOTT FRIEDLAND, MICHAEL FRIEDLAND, RENEE ROUSE, ROBIN FIELDS, MITCHEL A. FIELDS, and on behalf of all others similarly situated, Plaintiffs-Appellants, v. ADVOCATE HEALTH AND HOSPITALS CORPORATION d/b/a ADVOCATE MEDICAL GROUP, Defendant-Appellee.
NOTICE: This order was filed under Supreme Court Rule 23 and may not be cited as precedent by any party except in the limited circumstances allowed under Rule 23(e)(1). Appeal from the Circuit Court of Kane County. Nos. 13-CH-0998 13-L-538 Honorable James R. Murphy, Judge, Presiding. Appeal from the Circuit Court of Lake County. No. 13-CH-2701 Honorable Mitchell L. Hoffman, Judge, Presiding. JUSTICE JORGENSEN delivered the judgment of the court.
Presiding Justice Schostok and Justice Birkett concurred in the judgment.
ORDER
¶ 1 Held: In this data breach putative class action, the trial court did not err in dismissing plaintiffs' claims for lack of standing, where plaintiffs did not allege that any of their personal information was used in any unauthorized manner, where they asserted only an increased risk of such, and where their allegations of injury were conclusory and speculative. Affirmed. ¶ 2 In this consolidated appeal, plaintiffs filed putative class actions, raising claims of negligence, violations of the Personal Information Protection Act (PIPA) (815 ILCS 530/1 et seq. (West 2014)), the Consumer Fraud and Deceptive Business Practices Act (Fraud Act) (815 ILCS 505/1 et seq. (West 2014)), and invasion of privacy against defendants, Advocate Health and Hospitals Corporation and Advocate Health and Hospitals Corporation d/b/a Advocate Medical Group (collectively, Advocate), after four computers containing patient information were stolen from Advocate's offices. Plaintiffs did not allege that their personal information was used in any unauthorized manner as a result of the burglary, but that they face an increased risk of identity theft and/or identity fraud. Following Advocate's motion in each case under section 2-619.1 of the Code of Civil Procedure (Code) (735 ILCS 5/2-619.1 (West 2014)), the trial courts dismissed plaintiffs' complaints, with prejudice, pursuant to: (1) section 2-619(a)(9) of the Code, finding that the disclosure of confidential medical and personal information did not constitute an injury-in-fact sufficient to confer standing to pursue an action against Advocate; and, alternatively, (2) section 2-615 of the Code, finding that the complaints failed to state claims upon which relief could be granted. Plaintiffs appeal. We affirm.
¶ 3 I. BACKGROUND
¶ 4 Advocate is a network of affiliated doctors and hospitals that treat patients throughout the state. On July 15, 2013, burglars stole from Advocate's administrative building in Park Ridge four password-protected computers that contained certain information relating to about 4 million patients. Advocate subsequently notified the patients about the incident, set up a call center to answer their questions, and offered them one year of free credit-monitoring services, including identity theft resolution assistance and identity theft insurance. ¶ 5 On September 25, 2013, several plaintiffs sued Advocate in the circuit court of Lake County (appeal No. 2-14-0998). On October 24, 2013, several plaintiffs sued Advocate in the circuit court of Kane County (appeal No. 2-14-0782). Both actions were brought as putative class actions. ¶ 6 Both complaints asserted substantially similar allegations. Plaintiffs, patients or former patients of Advocate, alleged that the personal information of more than 4 million individuals contained in the four stolen computers, which have not been located, included their names, addresses, dates of birth, social security numbers, health insurance data, Medicare and Medicaid data, medical diagnoses, diagnoses codes, and medical record numbers. Advocate learned of the burglary on July 15, 2014, and notified plaintiffs on August 23, 2013. Plaintiffs alleged that the theft was caused by Advocate's violations of its obligations to abide by best practices and industry standards concerning the security of personal information and the computers associated therewith. They also alleged that Advocate failed to timely notify them of the breach and that Advocate's computers were not secure or unencrypted. Thus, they further alleged, Advocate facilitated and allowed for the unlawful disclosure of patients' private and confidential health information. (Plaintiffs did not allege that anyone had improperly accessed or used the information that was on the stolen computers or that they have suffered identity theft and/or identity fraud as a result of the burglary.) ¶ 7 Specifically, in their negligence counts, plaintiffs alleged that Advocate had a duty, pursuant to federal and state law, including the PIPA and Medical Patients Rights Act (410 ILCS 50/0.01 et seq. (West 2014)), and Fraud Act, to securely maintain and to not disclose or disseminate, without patient authorization, the personal information at issue. They alleged that Advocate breached this duty when it used unsecured, unencrypted computers to store such information and was negligent in permitting the unlawful and unauthorized disclosure of such information. Plaintiff asserted that, as a result of Advocate's breach, they suffered personal and pecuniary damages. ¶ 8 In their PIPA counts, plaintiffs alleged that Advocate was a "data collector" (815 ILCS 530/5 (West 2014) (defined as an "entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personal information")) and had a duty to disclose "immediately and/or in the most expedient time possible and without unreasonable delay" the data breach and that its failure to do so warranted an injunction be issued to require Advocate to comply with the statute. They also alleged that Advocate did not timely notify them of the disclosure. 815 ILCS 530/10(a) (West 2014) (to be made "in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system"). ¶ 9 In their counts pursuant to the Fraud Act, plaintiffs alleged that Advocate committed unfair acts by failing to maintain reasonable procedures to protect against unauthorized access to plaintiffs' personal information, such acts constituted an unfair trade practice, violated public policy because class members had no choice but to submit their information, Advocate intended that members rely on its unfair practices, and the practices were willful and wanton and continuing and widespread. Also, plaintiffs noted that a PIPA violation constituted an unlawful practice under the Fraud Act. 815 ILCS 530/20 (West 2014). ¶ 10 In their counts alleging invasion of privacy, plaintiffs asserted that Advocate's impermissible and unauthorized disclosure and dissemination constituted an unauthorized intrusion and invasion into plaintiffs' privacy and seclusion that was highly offensive to them and would be so to a reasonable person. Plaintiffs also alleged that Advocate's intrusion was an invasion of private matters, causing them anguish and suffering. Additionally, the plaintiffs in appeal No. 2-14-0998 included a count asserting intentional infliction of emotional distress. All plaintiffs sought class certification; damages, attorney fees, and costs; statutory interest and penalties; and injunctive and/or declaratory relief. ¶ 11 Advocate moved to dismiss plaintiffs' complaints, arguing that: (1) plaintiffs lacked standing because they did not suffer the requisite injury-in-fact (735 ILCS 5/2-619(a)(9) (West 2014)), where their claimed injury—merely that the information was stolen—was insufficient and any claim that plaintiffs face an increased risk of identity theft and identity fraud because their information could have been bought and sold several times on the black market was speculative; and (2) each count failed to state a claim upon which relief could be granted (735 ILCS 5/2-615 (West 2014)). ¶ 12 On May 27, 2014, in appeal No. 2-14-0998, the trial court dismissed, with prejudice, the Lake County plaintiffs' complaint. Addressing standing, the court found that allegations of possible future injury were insufficient to confer standing. Plaintiffs did not allege facts that "would plausibly establish an 'imminent' or 'certainly impending' risk that they will be victimized." The court further noted that "the harm that Plaintiffs fear is contingent on a chain of attenuated hypothetical events and actions by third parties independent of the defendant," noting that these included: whether their data was actually taken after the removal, whether it was subsequently sold or otherwise transferred, whether anyone attempted to use it, and whether or not they succeeded. The increased risk that plaintiffs will be identity theft victims at some indeterminate point in the future, the court determined, did not constitute an injury sufficient to confer standing, where the occurrence of such future injury rested on the criminal actions of independent decision-makers and where the complaint lacked sufficient factual allegations to show such future injury was imminent or certainly impending. ¶ 13 Addressing the PIPA and Fraud Act claims, the court found that, even assuming the statutes were violated when Advocate delayed or inadequately notified plaintiffs, the violations were insufficient to establish standing without any actual damages due to the breach. The time and expenses incurred to mitigate the risks of identity theft were also insufficient to confer standing because they involved a response to a speculative threat. Next, addressing plaintiffs' allegations concerning anxiety and emotional distress, the court found that these, too, were insufficient to establish standing, where they were not based on an imminent threat; rather, they alleged future criminal acts that were only speculative. Also, the court found that plaintiffs' loss-of-privacy allegations were insufficient to establish standing, where they did not plead that the information was disclosed. ¶ 14 Next, the trial court addressed Advocate's section 2-615 argument, finding in the alternative that plaintiffs' causes of action did not state claims upon which relief could be granted. As to negligence, the court determined that plaintiffs' allegations failed to allege a compensable present injury resulting in damage; thus, it dismissed this claim. Addressing the PIPA and Fraud Act claims, the court found that they did not allege viable causes of action because plaintiffs did not allege actual damages arising from statutory violations and could not rely on speculative future damages or presumed damages to support their claims. As to the invasion-of-privacy-by-public-disclosure-of-private-facts claim, the court found that the complaint failed to allege that Advocate disclosed and disseminated plaintiffs' private information; further, even if it did, it failed to allege publicity. Next, as to intentional infliction of emotional distress, the court determined that the complaint allegations were insufficient to satisfy the extreme-and-outrageous and causation-of-severe-emotional-distress elements of the cause of action. The complaint, it found, simply set forth conclusory allegations. ¶ 15 Finally, the court addressed Advocate's argument that the economic loss doctrine, which bars recovery in tort actions solely for economic losses, barred plaintiffs' tort claims. The trial court agreed with Advocate, noting the plaintiffs did not respond to this argument and that case law instructed that most of the alleged injuries were economic losses (except for emotional distress, which the court found to be viable where it was based on speculative harm) and, therefore, were barred because plaintiffs did not alleged they suffered personal injury or property damage and where no exceptions applied. ¶ 16 On July 10, 2014, in appeal No. 2-14-0782, the trial court dismissed, with prejudice, the Kane County plaintiffs' complaint. It determined that plaintiffs did not sufficiently allege standing, where they made no allegations of actual or impending certainty of identity theft. As to the damages element of negligence and the Fraud Act claims, the trial court found that dismissal was warranted because plaintiffs alleged only an increased risk of possible future identity theft, rather than any present harm. As to the invasion-of-privacy claim, the court similarly found it lacking, where, at most, defendant was negligent and where plaintiffs had voluntarily given Advocate the information at issue. As to the public disclosure of private facts theory, the court found that the allegations did not support two elements of such a claim: that Advocate had publicized the information or that the information was publicized at all. Finally, addressing the economic loss doctrine, the trial court found that plaintiffs could not recover for purely economic losses under a tort theory of negligence and none of the exceptions applied. ¶ 17 Plaintiffs appeal.
¶ 18 II. ANALYSIS
¶ 19 On appeal, plaintiffs argue that the trial courts' orders dismissing their complaints both for lack of standing and failure to state claims were erroneous. For the following reasons, we conclude that plaintiffs did not have standing to bring their suits. Accordingly, we need not reach the trial courts' alternative bases upon which they dismissed the complaints. ¶ 20 Advocate's motions to dismiss were brought pursuant to section 2-619.1 of the Code, which allows a party to move for dismissal under both sections 2-615 and 2-619. 735 ILCS 5/2-619.1 (West 2014). A section 2-615 motion to dismiss attacks the legal sufficiency of a complaint. Carr v. Koch, 2012 IL 113414, ¶ 27. In ruling on such a motion, a court must accept as true all well-pleaded facts in the complaint, as well as any reasonable inferences that may arise from them. Bonhomme v. St. James, 2012 IL 112393, ¶ 34. The critical inquiry is whether the allegations of the complaint, when construed in the light most favorable to the plaintiff, are sufficient to establish a cause of action upon which relief may be granted. Id. A cause of action should not be dismissed under section 2-615 unless it is clearly apparent from the pleadings that no set of facts can be proven that would entitle the plaintiff to recover. Khan v. Deutsche Bank AG, 2012 IL 112219, ¶ 47. ¶ 21 A motion brought pursuant to section 2-619 admits the sufficiency of the complaint, but asserts an affirmative defense or other matter that avoids or defeats that claim. Id. In ruling on a section 2-619 motion to dismiss, the court must interpret the pleadings and supporting materials in the light most favorable to the nonmoving party. Van Meter v. Darien Park District, 207 Ill. 2d 359, 367-68 (2003) (quoting In re Chicago Flood Litigation, 176 Ill. 2d 179, 189 (1997)). Lack of standing is an affirmative matter that is properly raised under section 2-619(a)(9). Glisson v. City of Marion, 188 Ill. 2d 211, 220 (1999). Where a plaintiff lacks standing, the proceedings must be dismissed because the lack of standing negates the plaintiff's cause of action. Wexler v. Wirtz Corp., 211 Ill. 2d 18, 22 (2004). We review de novo a dismissal under either section 2-615 or section 2-619. Carr, 2012 IL 113414, ¶ 27. ¶ 22 The doctrine of standing insures that issues are raised only by those parties with a real interest in the outcome of the controversy. Wexler, 211 Ill. 2d at 23. While determining whether a plaintiff has standing to sue depends on the allegations in the complaint (Barber v. City of Springfield, 406 Ill. App. 3d 1099, 1101 (2011)), the plaintiff need not allege facts in the complaint that establish standing (Chicago Teachers Union, Local 1 v. Board of Education, 189 Ill. 2d 200, 206 (2000)). Rather, a plaintiff's lack of standing is an affirmative defense and, as such, must be pleaded and proven by the defendant. Lebron v. Gottlieb Memorial Hospital, 237 Ill. 2d 217, 252 (2010). Further, in a class action, which plaintiffs seek this case to be, we focus on the named plaintiffs' allegations in assessing standing, not the general class they purport to represent. I.C.S. Illinois, Inc. v. Waste Management of Illinois, Inc., 403 Ill. App. 3d 211, 221 (2010). ¶ 23 Standing requires some injury in fact to a legally cognizable interest. Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462, 492-93 (1988) (diminution in value of property is a legally cognizable interest). To establish standing, the claimed injury may be actual or threatened and it must be: (1) distinct and palpable; (2) fairly traceable to the defendant's actions; and (3) substantially likely to be prevented or redressed by the grant of the requested relief. Carr, 2012 IL 113414, ¶ 28. This case focuses on the first element. ¶ 24 Turning first to Illinois case law, in Chicago Teachers Union, Local 1, certain high school physical education teachers and others challenged the constitutionality of a school code provision that allowed school districts to petition the State board to exempt a particular district from statutory provisions relating to the daily requirement for physical education. The supreme court held that the teachers did not have standing to challenge the statute, rejecting the teachers' allegations that they were injured due to lost employment opportunities if the waiver was granted. Chicago Teachers Union, Local 1, 189 Ill. 2d at 208. The court noted that any adverse consequences, such as diminished need for physical education teachers, was "purely speculative," as such classes would be elective rather than compulsory if a waiver were granted, where the scope of any reduction was "purely conjectural," and where the teachers, who were tenured, would still have the opportunity to teach ninth and tenth grade students, for whom there was no waiver. Id. at 207-08. The court concluded: "the teachers cannot be said to have sustained or be in immediate danger of sustaining a direct injury as a result of enforcement of the challenged statute that is distinct and palpable and substantially likely to be prevented or redressed by the grant of the requested relief." (Emphasis added.) Id. at 208. ¶ 25 Here, plaintiffs' allegations of injury are clearly speculative, and, therefore, they lack standing to bring suit. Their claims that they face merely an increased risk of, for example, identity theft are purely speculative and conclusory, as no such identity theft has occurred to any of the plaintiffs. Thus, their allegations fail to show that a distinct and palpable injury. ¶ 26 Federal standing principles are similar to those in Illinois, and the case law is instructive. In federal courts, to show standing under Article III of the Constitution, a plaintiff must establish the existence of an injury that is: (1) concrete, particularized, and actual or imminent; (2) fairly traceable to the challenged action; and (3) redressable by a favorable ruling. Clapper v. Amnesty Int'l USA, ___ U.S. ___, 133 S. Ct. 1138, 1147 (2013). As to the first prong, an "allegation of future injury may suffice if the threatened injury is 'certainly impending,' or there is a 'substantial risk' that the harm will occur." (Emphases added.) Susan B. Anthony List v. Driehaus, ___ U.S. ___, 134 S. Ct. 2334, 2341 (2014). The Clapper court noted, however, that " '[a]llegations of possible future injury' are not sufficient." (Emphasis added; internal quotation marks omitted.) Clapper, 113 S. Ct. at 1147 (quoting Whitmore v. Arkansas, 495 U.S. 149, 158 (1990)). It also rejected the objectively-reasonable-likelihood standard, as inconsistent with the requirement that the threatened injury be certainly impending to constitute injury in fact; a theory that relies on a highly attenuated chain of events, it noted, does not meet the certainly impending standard. Id. at 1147-48. See, e.g., Peters v. St. Joseph Services Corp., ___ F. Supp. 3d ___, 2015 WL 589561, *7 (S.D. Texas 2015) (putative class action against hospital system following data breach dismissed, where the plaintiff did not have standing to bring her federal claims; the heightened risk of future identity theft/fraud posed by the data security breach did not confer Article III standing on persons whose information may have been accessed). ¶ 27 Clapper and Susan B. Anthony are the Supreme Court's most recent pronouncements on standing that address the first prong at issue here. However, plaintiffs rely on Pisciotta v. Old National Bank Corp., 499 F.3d 629 (7th Cir. 2007), a pre-Clapper decision, to argue that a mere increased risk of harm is sufficient to serve as the basis for injury-in-fact and confers standing. Id. at 634 (noting that "the injury-in-fact requirement can be satisfied by a threat of future harm or by an act which harms the plaintiff only by increasing the risk of future harm that the plaintiff would have otherwise faced, absent the defendant's actions") (Emphasis added.) We agree with other courts that have held that Clapper "compels rejection of [the plaintiffs'] claim that an increased risk of identity theft is sufficient to satisfy the injury-in-fact requirement for standing." Strautins v. Trustwave Holdings, Inc., 27 F. Supp. 3d 871, 876 (N.D. Ill. 2014); see also In re Barnes & Noble Pin Pad Litigation, 2013 WL 4759588 (N.D. Ill. 2013), at * 3; Peters, ___ F. Supp. 3d at ___, 2015 WL 589561, at *7. Thus, we do not view Pisciotta, which would be merely persuasive authority at best (Westlake Financial Group, Inc. v. CDH Delnor Health System, 2015 IL App (2d) 140589, at ¶ 43), as instructive. As another court has noted, "an increased risk or credible threat of impending harm is plainly different from certainly impending harm, and certainly impending harm is what the Constitution and Clapper require." In re: Science Applications International Corp. (SAIC) Backup Tape Data Theft Litigation, 45 F. Supp. 3d 14, 28 (D.C. 2014). As plaintiffs here have not alleged that their personal information has actually been used or that they have been victims of identity theft or fraud, the arguably increased risk of such acts as a result of Advocate's data breach is insufficient to confer standing as that concept is applied in federal cases. ¶ 28 Plaintiffs further argue that the nature of the data here, medical information, warrants a finding that the harm is implicit. They urge that an actual injury occurs when a medical professional fails to keep a patient's medical information private. The information is, they assert, inherently personal and particularized to the individual. We reject plaintiffs' argument. They rely on Tabata v. Charleston Area Medical Center, Inc., 759 S.E.2d 459 (W. Va. 2014), a case where the court held that the petitioners, whose medical records were accidentally placed on the internet, had standing under state law to bring causes of action for breach of confidentiality and invasion of privacy Id. at 517-18. Tabata is distinguishable because the data in that case was actually published on the internet for six months (id. at 515 n.1), whereas, here, there has been no public disclosure or identity fraud with respect to plaintiffs' data in the nearly two years since the burglary. ¶ 29 Plaintiffs also argue that their claims do not rest on a speculative chain of possibilities, but, rather, on actions that already occurred: the computers were stolen; unencrypted information is accessible and recoverable to anyone having access to the computers; the data has significant monetary value; there is a known market for the sale of the data; and "it can be deduced that the data is being used to the detriment of the" victims. They also point to a similar lawsuit filed in federal court, where two victims of the Advocate burglary documented actual exposure to identity theft and fraud. See Tierney v. Advocate Health & Hospitals Corp., 2014 WL 5783333 (N.D. Ill. 2014) (finding that four of the plaintiffs alleged only a speculative fear that the information could have been bought and sold and placed them at risk for identity theft, identity fraud, and medical fraud; "[w]ithout any allegations to support their mere conclusion of imminent harm, they fail to establish standing;" however, with respect to the two plaintiffs who alleged that they were injured, where each was notified of fraudulent activity, such as attempted access to bank accounts and opened cell phone accounts, they sufficiently alleged standing). ¶ 30 We reject plaintiff's arguments and note again that their allegations are merely speculative. They alleged in their complaint that the records of 4 million patients were affected by the Advocate burglary. The fact that only two plaintiffs to date out of those 4 million can point to receiving notification of fraudulent activity, i.e., alleging a causal relationship between their injuries and Advocate's alleged wrongful acts, does not show that plaintiffs here face imminent, certainly impending, or a substantial risk of harm as a result of the burglary, where no such activity has occurred with respect to their personal data. Plaintiffs here are like the four plaintiffs in Tierney who were unable to allege actual injury and with respect to whom the district court found had no standing. ¶ 31 We also reject plaintiffs' claims that they sufficiently alleged "appreciable emotional injury" as a result of the burglary. Plaintiffs again point to the two Tierney plaintiffs who received notification of fraudulent activity. They argue that it can be deduced that their data is being viewed and used in a malicious way, causing them anxiety and emotional distress. Again, given the speculative and conclusory nature of their allegations and the lack of imminent, certainly impending, or substantial risk of harm, this argument fails. See, e.g., Crisafulli v. Ameritas Life Insurance Co., ___ F. Supp. 3d ___, 2015 WL 1969176 (D. N.J. 2015), *4 (noting that courts "across the country have rejected 'emotional distress' as a basis for standing") (citing SAIC, 45 F. Supp. 3d at 26 (the plaintiffs "do not have standing based on risk alone, even if their fears are rational")); Barnes & Noble, 2013 WL 4759588, at *5 (anxiety insufficient to establish standing, where there was no imminent threat of the plaintiff's information being used in a malicious way). ¶ 32 Finally, plaintiffs argue that their invasion of privacy claims should not have been dismissed for lack of standing. They contend that the release of the information is sufficiently egregious without having to show access because the privacy of their health care has been compromised. We reject this argument because case law requires disclosure to a third party and plaintiffs have made no such allegations. See SAIC, 45 F. Supp. 3d at 28-29 (citing cases and holding that the plaintiffs in that case who did not contend that their personal information was viewed or exposed in any way that would facilitate easy, imminent access did not have standing based on invasion of privacy; rather, they were "out of luck"); Barnes & Noble, 2013 WL 4759588, at *4 (lack of facts alleging disclosure fatal to privacy argument); see also Ainsworth v. Century Supply Co., 295 Ill. App. 3d 644, 648 (1998) (public disclosure is an element of invasion of privacy tort). ¶ 33 Because we affirm the trial courts' dismissals on the basis of Advocate's standing arguments under section 2-619(a)(9) of the Code, we need not reach the alternative arguments based on Advocate's motion pursuant to section 2-615 of the Code.
There appears to be an intra-circuit split in the Seventh Circuit, with two courts ruling that Clapper abrogated Pisciotta and one court ruling otherwise. Compare Strautins, 27 F. Supp. 3d 871, and Barnes & Noble, 2013 WL 4759588, at *3, with Moyer v. Michaels Stores, Inc., 2014 WL 3511500 (N.D. Ill. 2014) at *5 (disagreeing that Clapper overruled Pisciotta).
It is has also been criticized as poorly reasoned. Peters, ___ F. Supp. 3d ___, at *6 n.9 (noting that medical device, toxic substance, and environmental injury cases, upon which Pisciotta drew analogies, were separate and distinguishable categories from data breach cases; in environmental injury cases, the standing question was not whether damage had occurred, but rather, how it would manifest; further, monetary awards would likely restore data breach victims to their original position, whereas they might not adequately remedy the harms suffered by environmental injury victims).
Advocate alleged in its filings that the computers were password-protected.
--------
¶ 34 III. CONCLUSION
¶ 35 For the reasons stated, the judgment of the circuit court of Kane County is affirmed, as is the judgment of the circuit court of Lake County. ¶ 36 Affirmed.