Petta v. Christie Business Holding Co.

2023 IL App (5th) 220742 NOTICE Decision filed 11/28/23. The text of this decision may be NO. 5-22-0742 changed or corrected prior to the filing of a Peti ion for IN THE Rehearing or the disposition of the same. APPELLATE COURT OF ILLINOIS FIFTH DISTRICT ______________________________________________________________________________ REBECCA PETTA, on Her Own Behalf and on ) Appeal from the Behalf of Those Similarly Situated, and JANE ) Circuit Court of DOE, on Her Own Behalf and on Behalf of Those ) Champaign County. Similarly Situated, ) ) Plaintiffs-Appellants, ) ) v. ) No. 22-LA-51 ) CHRISTIE BUSINESS HOLDING ) COMPANY, P.C., d/b/a Christie Clinic, ) Honorable ) Jason M. Bohm, Defendant-Appellee. ) Judge, presiding. ______________________________________________________________________________ JUSTICE MOORE delivered the judgment of the court, with opinion. Justices Welch and Barberis concurred in the judgment and opinion. OPINION ¶ 1 In this matter, the plaintiffs, Rebecca Petta and Jane Doe, appeal the circuit court of Champaign County’s October 28, 2022, order, dismissing their complaints pursuant to sections 2- 615 and 2-619, respectively, of the Code of Civil Procedure (Code) (735 ILCS 5/2-615, 2-619 (West 2022)). The circuit court dismissed Doe’s complaint for lack of standing and did not consider her substantive claims. The circuit court dismissed Petta’s negligence claims and claim for violation of the Personal Information Protection Act (815 ILCS 530/45(a) (West 2022)) for failure to state a claim. On appeal, the plaintiffs challenge the circuit court’s dismissals. For the following reasons, we affirm. 1 ¶ 2 I. BACKGROUND ¶ 3 The defendant is a physician-owned medical group that provides medical services throughout Illinois. As a part of its medical services, the defendant gathers and stores patient identification information and health information. Sometime between July 14 and August 19, 2021, a cybercriminal compromised one of the defendant’s business e-mail accounts via a phishing attack. When the defendant discovered the illicit monitoring of the business e-mail account, it “launched an internal investigation to determine the nature and scope of this incident, and contacted federal law enforcement and worked with them to mitigate the impact of the unauthorized access.” ¶ 4 Following the investigation, the defendant “provided written notice to all affected individuals whose information was identified in its review.” It further notified the U.S. Department of Health and Human Services, the attorneys general in the affected states, and the Montana Office of Consumer Protection. According to a notification letter sent by the defendant, which was attached to the plaintiffs’ complaints, “there was unauthorized access to the affected email account from July 14, 2021 to August 19, 2021,” and based upon the defendant’s forensic review of the illicit activity, patient names, addresses, Social Security numbers, medical information, and health insurance information may have been stolen. The extent of the access gained by the cybercriminal is somewhat disputed, with the defendant’s disclosure stating that the “unauthorized actor did not have access to the electronic medical record, MyChristie patient portal, or Christie Clinic’s network” but also indicating that “the extent of the access is unknown and cannot be determined.” Additionally, the defendant offered free credit monitoring services for 12 to 24 months to potentially affected individuals. 2 ¶ 5 Following the notification, Doe filed a lawsuit against the defendant alleging claims of negligence, breach of implied contract, unjust enrichment, violation of the Consumer Fraud and Deceptive Business Practices Act (Consumer Fraud Act) (815 ILCS 505/1 et seq. (West 2020)), breach of fiduciary duty, and invasion of privacy. She alleged that she spent time and effort to mitigate any risk due to the breach but did not provide any further specifics. Doe alleged only that the information was improperly accessed in the general sense and did not allege any specific acts of identity theft or identity fraud of her personal information. ¶ 6 Plaintiff Petta also filed a lawsuit against the defendant following the data breach. Petta brought claims for negligence, negligence per se based on the Federal Trade Commission Act ( 15 U.S.C. § 45 (2018)), negligence per se based on the Health Insurance Portability and Accountability Act of 1996 ( 45 C.F.R. § 160.102 (2013)), violation of the Personal Information Protection Act (815 ILCS 530/10 (West 2020)), and injunctive relief. Petta alleged damages of “ongoing and imminent threat of identity theft crimes; out-of-pocket expenses incurred to mitigate the increased risk of identity theft and/or fraud; credit, debit, and financial monitoring to prevent and/or mitigate theft, identity theft, and/or fraud incurred or likely to occur as a result of Defendant’s security failures; the value of her time and resources spent mitigating the identity theft and/or fraud; decreased credit scores and ratings; and irrevocable financial losses due to fraud.” ¶ 7 Following the filing of both cases, the defendant moved to consolidate the matters, and the circuit court granted the defendant’s motion. Then the defendant filed a combined section 2-615 and 2-619 motion to dismiss both of the complaints wherein the defendant argued that, pursuant to section 2-619(a)(9) of the Code (735 ILCS 5/2-619(a)(9) (West 2022)), both Doe and Petta lacked standing to bring the lawsuit because neither of them suffered an actual injury and, 3 additionally, pursuant to section 2-615, each of the claims brought by Doe and Petta are insufficient as a matter of law. ¶ 8 After completion of pleadings and argument on the matter, the circuit court granted the defendant’s motion and dismissed both complaints in a detailed 13-page order. The circuit court dismissed Doe’s complaint based upon a lack of standing because it found Doe’s allegations of wrongdoing and injury too speculative and the harm not to be imminent. The circuit court found Petta’s standing-related allegations “less speculative” and instead dismissed the complaint based upon a failure to state valid claims. ¶ 9 This appeal followed. ¶ 10 II. ANALYSIS ¶ 11 Both Doe and Petta challenge the dismissal of their complaints on appeal. Thus, there are essentially two overarching issues presently before this court. First is whether the plaintiffs have standing to bring their claims. Second is whether the claims as stated by the plaintiffs are sufficient as a matter of law. The circuit court found that Doe lacked standing and that Petta failed to state a legally sufficient claim. In evaluating motions to dismiss, the circuit court must “interpret all of the pleadings and supporting documents in the light most favorable to the nonmoving party,” accepting as true “all well-pled allegations in the complaint and reasonable inferences to be drawn from the facts.” Kopchar v. City of Chicago, 395 Ill. App. 3d 762, 772 (2009). ¶ 12 The United States Supreme Court has held that a court may not decide a cause of action on the merits prior to determining whether the plaintiff has standing to bring the claim. Steel Co. v. Citizens for a Better Environment, 523 U.S. 83, 94-95 (1998). This is because “ ‘[w]ithout jurisdiction the court cannot proceed at all in any cause. Jurisdiction is power to declare the law, and when it ceases to exist, the only function remaining to the court is that of announcing the fact 4 and dismissing the cause.’ ” Id. at 94 (quoting Ex parte McCardle, 74 U.S. 506, 514 (1869)). Thus, we first look to the issue of standing to determine whether the circuit court was correct in dismissing Doe’s claim for lack of standing and finding that Petta alleged sufficient facts for standing to be found. ¶ 13 We first examine the circuit court’s determination that Doe lacked standing to bring her claims. “Lack of standing is an ‘affirmative matter’ that is properly raised under section 2- 619(a)(9).” Glisson v. City of Marion, 188 Ill. 2d 211, 220 (1999). “An order granting this type of motion to dismiss is given de novo review on appeal.” Id. Illinois courts have “set forth the general principle that standing requires some injury in fact to a legally cognizable interest in Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462, 492 (1988).” Id. at 221. “The claimed injury may be actual or threatened, and it must be (1) distinct and palpable; (2) fairly traceable to the defendant’s actions; and (3) substantially likely to be prevented or redressed by the grant of the requested relief.” Id. Any threatened injury must be “certainly impending” or must create a “substantial risk” of harm, as opposed to being merely “possible.” Maglio v. Advocate Health & Hospitals Corp., 2015 IL App (2d) 140782, ¶¶ 25, 26, 29 . “This court has held that a party cannot gain standing merely through a self-proclaimed interest or concern about an issue, no matter how sincere.” Glisson, 188 Ill. 2d at 231 . ¶ 14 When conducting our analysis of the standing issue, we find the case of Maglio, 2015 IL App (2d) 140782 , to be instructive and factually similar. In Maglio, burglars broke into an administrative building of the defendant, a network of affiliated doctors and hospitals in Illinois. Id. ¶ 3. The burglars stole computers from the defendant that contained “certain information relating to about 4 million patients.” Id. Some of the affected patients then sued the defendant for negligence, violation of the Personal Information Protection Act, the Consumer Fraud Act, and 5 invasion of privacy, similar to this matter. Id. ¶ 1. The patients “did not allege that their personal information was used in any unauthorized manner as a result of the burglary, but they claimed that they face an increased risk of identity theft and/or identity fraud.” Id. They also claimed they incurred “time and expenses *** to mitigate the risk of identity theft” and suffered “anxiety and emotional stress.” Id. ¶¶ 10, 12. They further claimed that the defendant’s failure to abide by industry-standard security practices facilitated the disclosure of the patient information. Id. ¶ 5. The circuit court dismissed the claims for lack of standing, and the plaintiffs appealed. Id. ¶ 11. The appellate court found such claims of an “increased risk of, for example, identity theft” to be “purely speculative and conclusory.” Id. ¶ 24. Therefore, because the allegations “fail[ed] to show a distinct and palpable injury,” the appellate court found the patients in Maglio lacked standing. (Emphasis in original.) Id. Put another way, despite the information being stolen, at that time, none of the plaintiffs had been victimized, and speculation or fear alone was insufficient to confer standing. ¶ 15 Doe’s claims essentially mirror those laid out in Maglio. Most significantly, Doe does not allege that her information has been improperly used or that she has suffered identity theft and/or identity fraud because of the data breach. Doe admits in her complaint that she “is unsure of what has happened to her [personally identifying information] and [personal health information].” Thus, while she claims she has spent “considerable time and effort monitoring her accounts to protect herself from identity theft,” those allegations do not differ from those set forth in Maglio, which were rejected as “speculative fear.” Id. ¶ 28. Thus, based upon Maglio and the reasoning therein, we also find that Doe’s claims of an “increased risk of identity theft” and her damages of “time and effort” in monitoring and combating potential identity theft are simply too speculative and not imminent so as to confer standing. 6 ¶ 16 Both plaintiffs rely on a string of federal case law that appears to have reached different outcomes regarding standing in data breach cases than that found in Maglio. However, as noted in Maglio, Illinois courts have departed from the standard set forth in the Seventh Circuit by requiring more than “increased risk of harm” in data breach cases. Id. ¶ 26. This departure does not affect or negate Maglio, however, because the Illinois Supreme Court has explained that it “is not required to follow federal law on issues of standing, and has expressly rejected federal principles of standing.” Lebron v. Gottlieb Memorial Hospital, 237 Ill. 2d 217 , 254 n.4 (2010); see Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462, 494 (1988); see also Bryant v. Compass Group USA, Inc., 958 F.3d 617, 622 (7th Cir. 2020). Thus, although we acknowledge that there exists federal case law that has determined factually similar cases differently for the purposes of standing, we agree with the reasoning of the Maglio court and decline to depart from it. ¶ 17 Doe’s additional argument that she has a property interest in her personal information and that the data breach somehow diminished the value of her property also fails. First, this court does not find that a person’s personal information is “property.” This court is unaware of any case law holding that a person has a property right in her personal information. The federal courts have refrained from finding such a right, and we decline to create one. See Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688, 695 (7th Cir. 2015) (“This assumes that federal law recognizes such a property right. Plaintiffs refer us to no authority that would support such a finding. We thus refrain from supporting standing on such an abstract injury, particularly since the complaint does not suggest that the plaintiffs could sell their personal information for value.”). Additionally, even if such a right did exist, we cannot determine any nonspeculative way to assess the diminution in value of the property right. See Dinerstein v. Google, LLC, 484 F. Supp. 3d 561 , 578 (N.D. Ill. 2020). We also note that Petta also puts forth a similar argument. Petta offers various sources that 7 suggest certain dollar amounts that this personal information can be sold for on the black market or dark web. However, Petta fails to offer any indication of how the dissemination of the personal information would affect its value. Thus, for us to attempt to determine the diminution in value of the property right, should we determine it existed, again, would simply be pure speculation. ¶ 18 Thus, based upon the foregoing, we find that Doe lacks standing to bring her claims against the defendant and the circuit court property dismissed Doe’s complaint. ¶ 19 We now turn to Petta’s complaint. The allegations contained in Petta’s complaint are similar to those in Doe’s complaint. Of importance, Petta alleged the same shortcomings by the defendant and contends that the relaxed security in place failed to meet industry standards and resulted in the hacker’s ability to steal the personal information. Petta alleged the same damages as Doe including “ongoing and imminent threat of identity theft crimes; out-of-pocket expenses incurred to mitigate the increased risk of identity theft and/or fraud; credit, debit, and financial monitoring to prevent and/or mitigate theft, identity theft, and/or fraud incurred or likely to occur as a result of the Defendant’s security failures; the value of her time and resources spent mitigating the identity theft and/or fraud; decreased credit scores and ratings; and irrevocable financial losses due to fraud.” Again, just as with Doe’s complaint, Petta offers no additional allegations that give us any further details or specificity as to the amount or the extent of those damages. Thus, such conclusory allegations are not sufficient. ¶ 20 However, the most significant difference, and what the circuit court relied upon in finding standing existed for Petta, was her allegation that she “experienced suspicious behavior” in that someone applied for a loan using her phone number and address. Specifically, Petta alleges the following in her complaint: 8 “Since the Data Breach, Petta has experienced suspicious behavior in connection with her phone number and address. Her phone number, city, and state have been used in connection with a loan application at First Financial Bank, Columbus, Ohio, in someone else’s name. Petta received multiple phone calls in recent months regarding loan applications she did not initiate.” ¶ 21 “Illinois is a fact-pleading state, and conclusions of law and conclusory factual allegations unsupported by specific facts are not deemed admitted.” Alpha School Bus Co. v. Wagner, 391 Ill. App. 3d 722, 735 (2009). “In addition, a pleading that merely paraphrases the elements of a cause of action in conclusory terms is insufficient.” Id. Petta’s claim that she has received phone calls regarding loan applications that she did not initiate simply falls short of this standard. It is too conclusory and lacks sufficient facts for us to properly evaluate. Additionally, her general claim that she “experienced suspicious behavior” also leaves us wanting. However, even assuming it is sufficient for the purposes of fact pleading, it would still fail to meet all the requirements of standing. ¶ 22 As previously stated, to confer standing, a “claimed injury may be actual or threatened, and it must be (1) distinct and palpable; (2) fairly traceable to the defendant’s actions; and (3) substantially likely to be prevented or redressed by the grant of the requested relief.” Glisson, 188 Ill. 2d at 221 . Here, we find that the claimed injury fails the “fairly traceable to the defendant’s actions” requirement. ¶ 23 Petta alleges only that her phone number and address were used. Based upon her complaint, no other personal information, such as her name, her Social Security number, insurance information, etc., was misused. She makes no direct allegation that the fraudulent loan application (which was apparently detected and thwarted prior to the loan being approved) resulted as a direct 9 consequence from the data breach. Nor does she allege with any specificity that this application damaged her in any way. Moreover, this court sees no way in which Petta could, in good faith, allege that loan application activity is “fairly traceable” back to the defendant’s action. This is because the information used, Petta’s phone number and address, is publicly available information that anyone could readily obtain via a quick Internet search. 1 Petta does not allege that her name or Social Security number or other “identifying” information was used. As a result, this allegation alone is “purely speculative” because there is no apparent connection between the purported fraudulent loan attempt and the data breach at issue. Anyone could have committed the fraud using the same readily available public information. There is no way, outside of speculating, for this court to determine that, had these hackers not breached the defendant’s e-mail, Petta’s phone number and address would still not have been used fraudulently. The information would still have been public had this breach not occurred. Thus, we cannot trace the fraudulent activity back to the defendant’s actions. Additionally, generally for an injury to be “fairly traceable to the defendant’s conduct means in part that the injury must not be the product of some independent action taken by a third party that is not before the court.” In re Grason, 486 B.R. 448, 457 (Bankr. C.D. Ill. 2013) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). Thus, here, we have the independent hackers who are responsible for this data breach, which are not before this court. This is not a case where the defendant accidentally or intentionally disseminated the information. The information was stolen by criminals. 1 Defendant on appeal contends that Petta’s phone number and address are publicly available on the Internet. This court conducted a quick Google search and was able to locate Petta’s information. “[A]n appellate court may take judicial notice of matters not previously presented to the trial court when the matters are capable of instant and unquestionable demonstration.” Boston v. Rockford Memorial Hospital, 140 Ill. App. 3d 969, 972 (1986). Therefore, because this court was able to instantly corroborate the claim by the defendant, we take judicial notice that Petta’s phone number and address are publicly available and accessible by anyone with Internet access as of the date of the filing of this disposition. 10 ¶ 24 Again, the other allegations in Petta’s complaint track the ones articulated by Doe (hackers gained access to patient information, breach created risk or threat of identity theft, time and effort were spent in mitigation, etc.), and for the same reasons as stated above when addressing Doe’s complaint, Petta’s allegations also fail as conclusory allegations that do not meet the required standard as articulated under Maglio. ¶ 25 Finally, we note another aspect of the “fairly traceable” requirement, which is that “[s]elf- inflicted harm does not confer standing because it does not qualify as an injury *** because it is not traceable to the defendant’s conduct.” Id. Thus, Doe’s and Petta’s allegations of time and effort spent monitoring their accounts and out-of-pocket expenses cannot support standing “because [it] involve[s] a response to a speculative threat.” Maglio, 2015 IL App (2d) 140782, ¶ 12 . “In other words, [plaintiffs] cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Clapper v. Amnesty International USA, 568 U.S. 398, 416 (2013). This is especially true in a case such as this, where the defendant offered free credit and identity monitoring services following the breach to mitigate any issues. ¶ 26 Thus, while we find that the circuit court erred by finding that Petta’s allegations contained within her complaint properly conferred standing for the reasons stated above, we agree with the circuit court’s dismissal of her complaint. “[W]e may affirm the trial court ‘for any reason or ground appearing in the record regardless of whether the particular reasons given by the trial court, or its specific findings, are correct or sound.’ ” Akemann v. Quinn, 2014 IL App (4th) 130867, ¶ 21 (quoting BDO Seidman, LLP v. Harris, 379 Ill. App. 3d 918, 923 (2008)). Therefore, because the allegations in Petta’s complaint were too speculative and cannot be “fairly traced” back to the 11 defendant’s conduct where the only information claimed to be used is readily available public information, we agree with the circuit court’s dismissal of Petta’s complaint. ¶ 27 III. CONCLUSION ¶ 28 For the foregoing reasons, we affirm the circuit court’s October 28, 2022, order dismissing the plaintiffs’ complaints. ¶ 29 Affirmed. 12 Petta v. Christie Business Holding Co., 2023 IL App (5th) 220742 Decision Under Review: Appeal from the Circuit Court of Champaign County, No. 22LA-51; the Hon. Jason M. Bohm, Judge, presiding. Attorneys David Cates, of Cates Law Firm, LLC, of Swansea, Brian C. for Gudmundson (pro hac vice), David M. Cialkowski, Michael J. Appellant: Laird, (pro hac vice), and Rachel K. Tack (pro hac vice), of Zimmerman Reed LLP, of Minneapolis, Minnesota, Christopher D. Jennings (pro hac vice), of Johnson Firm, of Little Rock, Arkansas, , Samuel J. Strauss and Raina C. Borrelli, of Turke & Strauss LLP, of Madison, Wisconsin, Lynn Toops, Lisa M. La Fornara, and Arend J. Abel, of Cohen & Malad, LLP, of Indianapolis, Indiana, and J. Gerard Stranch IV, of Branstetter, Stranch & Jennings, PLLC, of Nashville Tennessee, for appellants. Attorneys Jonathan B. Amarilio, Jeffrey M. Schieber, and Jaimin H. Shah, for of Taft Stettinius & Hollister LLP, of Chicago, for appellee. Appellee: 13