Print
On August 6, 2015, the Illinois Court of Appeals issued its opinion in Maglio v. Advocate Health and Hosp. Corp., dismissing the complaints filed in two class action lawsuits seeking damages related to a theft of Advocate Health’s computers containing information of approximately four million hospital patients. After a burglary on July 15, 2013, Advocate Health immediately notified patients of the incident, set up a call center to answer questions and offered the patients one year of free credit-monitoring services. By September 2013, class action lawsuits had been filed in Lake and Kane County, Illinois (the two circuit court actions had been consolidated by the time they reached the appellate court).
Plaintiffs filed class action complaints based on claims of negligence and invasion of privacy, violations of the Illinois Personal Information Protection Act and the Consumer Fraud and Deceptive Practices Act. The class action complaints did not allege that the Plaintiffs’ personal information was actually used after the computers were stolen. Rather, the Plaintiffs claim they faced “an increased risk of identity theft and/or identity fraud.” The trial court granted Advocate Health’s motion to dismiss finding the disclosure of the information “did not constitute an injury-in-fact sufficient to confer standing,” and the class action complaints failed to state a claim upon which relief could be granted.
The Court of Appeals upheld Lake County circuit court’s decision to dismiss Plaintiffs’ complaint based on the finding that Plaintiffs did not allege facts that “would plausibly establish an ‘imminent’ or ‘certainly impending’ risk that they will be victimized.” Likewise, the Court of Appeals upheld Kane County circuit court’s decision to dismiss the Plaintiffs’ complaint on the same grounds. In addition to addressing the standing issue seen in various federal court decisions recently, the Court of Appeals further noted its decision was impacted by the fact that only two plaintiffs (out of the 4 million patients that had their information taken) received notice of any fraudulent activity related to their personal information.
Coincidentally, the Court of Appeals decision finding Plaintiffs lacked standing to file a lawsuit related to Advocate Health’s data breach was issued after the Seventh Circuit’s July 20, 2015 decision in Remijas v. Neiman Marcus Group, LLC, finding plaintiffs had standing to file suit. The decisions in Remijas and Maglio, both arising out of data breaches in Illinois and litigated in Illinois courts, demonstrate that questions related to standing have not been fully resolved. Therefore, the facts related to a particular data breach and the aftermath of that data breach will be determinative on the standing issue.