{"id":2005,"date":"2025-01-31T16:05:48","date_gmt":"2025-01-31T20:05:48","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2005"},"modified":"2025-01-31T16:05:49","modified_gmt":"2025-01-31T20:05:49","slug":"illinois-supreme-court-affirms-dismissal-of-data-breach-class-action-for-lack-of-standing","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2025\/01\/31\/illinois-supreme-court-affirms-dismissal-of-data-breach-class-action-for-lack-of-standing\/","title":{"rendered":"Illinois Supreme Court Affirms Dismissal Of Data Breach Class Action For Lack Of Standing"},"content":{"rendered":"\n

By Gerald L. Maatman, Jr., Justin Donoho, and George J. Schaller<\/strong><\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

Duane Morris Takeaways<\/em>: <\/strong>On January 24, 2025, i<\/strong>n Petta v. Christie Bus. Holdings Co., P.C., 2025 IL 130337, the Illinois Supreme Court ruled <\/a>that a plaintiff lacked standing under Illinois law to bring her class action complaint alleging that her social security number and insurance information may have been accessed in connection with a data incident where a medical provider discovered unauthorized access to one of its business email accounts.\u00a0 The ruling is significant because it shows that data breach claims cannot be brought in Illinois court without specifying actual injury that is fairly traceable to the breach.<\/em><\/p>\n\n\n\n

Case Background<\/strong><\/p>\n\n\n\n

This case is one of the thousands of data breach class actions filed in the last three years.  In Petta<\/em>, Plaintiff brought suit against a medical provider.  According to Plaintiff,  she received a letter from the provider titled \u201cNotice of Data Incident\u201d explaining that an unknown third party gained unauthorized access to one of its business email accounts for about a month, in an attempt to intercept a business transaction between the provider and a third-party vendor.  Id. <\/em>\u00b6\u00b6 1, 6.  The letter also stated that \u201cthe impacted account MAY<\/em> have contained certain information related\u201d to Plaintiff\u2019s social security number and medical insurance information but \u201c[t]he unauthorized actor did not have access to [the provider\u2019s] electronic medical record\u201d and there was no \u201cevidence of identity theft or misuse of [Plaintiff\u2019s] personal information.\u201d  Id. <\/em>\u00b6 6 (emphasis in letter).The letter concluded by offering Plaintiff 12 months of credit monitoring and identity protection services at no cost if she wished to enroll.  Id.<\/em>, \u00b6 7.<\/p>\n\n\n\n

Plaintiff also alleged her \u201cphone number, city, and state [were] used in connection with a loan application \u2026 in someone else\u2019s name\u201d and she received multiple calls regarding \u201cloan applications she did not initiate.\u201d  Id.<\/em>, \u00b6 9.   <\/p>\n\n\n\n

Based on these allegations, Plaintiff alleged claims for negligence and violation of Illinois\u2019 Personal Information Protection Act. <\/p>\n\n\n\n

The trial court dismissed the complaint for lack of a viable legal theory and a bar by the economic loss doctrine.  The Illinois Appellate Court affirmed, but on the basis that the Plaintiff lacked standing to bring the action on behalf of herself and the putative class. <\/p>\n\n\n\n

Plaintiff thereafter appealed to the Illinois Supreme Court. <\/p>\n\n\n\n

The Illinois Supreme Court\u2019s Opinion<\/strong><\/p>\n\n\n\n

The Illinois Supreme Court affirmed and ruled Plaintiff lacked standing and affirmed the dismissal of her complaint on that basis.  Id.<\/em>, \u00b6 25.<\/p>\n\n\n\n

In Illinois, standing requires an injury in-fact. As a result, the Illinois Supreme Court reasoned that a plaintiff alleging only \u201ca \u2018purely speculative\u2019 future injury\u201d and \u201cno \u2018immediate danger of sustaining a direct injury\u2019 lacks sufficient interest to have standing.\u201d  Id. <\/em>\u00b6 18 (quoting Chi. Teachers Union, Local 1 v. Bd. of Ed. of Chi.<\/em>, 189 Ill. 2d 200, 206-07 (2000)). <\/p>\n\n\n\n

The Illinois Supreme Court affirmed Plaintiffs\u2019 lack of standing, reasoning that she, and the putative class, faced \u201conly an increased <\/em>risk that their private personal data was accessed by an unauthorized third party\u201d and that \u201can increased risk of harm is insufficient to confer standing\u201d in a complaint seeking money damages.  Id.<\/em>, \u00b6 21.  The Illinois Supreme Court opined nothing \u201cin the letter suggest[ed] that it is likely the third party did, in fact, take the [private personal] data\u201d and the provider\u2019s investigation revealed that the unauthorized third party was \u201cattempting to intercept a financial transaction, not steal patients\u2019 private personal information.\u201d Id<\/em>, \u00b6 20. <\/em><\/p>\n\n\n\n

The Illinois Supreme Court also noted that Plaintiff\u2019s unauthorized loan application related solely to Plaintiff and her complaint did not present any allegations that putative class members had a similar experience regarding a loan application.  Id.<\/em>, \u00b6 23.  However, the Illinois Supreme Court declined to answer the question of whether standing must be shown at the outset for the entire putative class and instead focused \u201csolely on [Plaintiff] individually,\u201d finding that \u201cPlaintiff\u2019s allegation regarding the loan application is insufficient to confer standing.\u201d  Id. <\/em><\/p>\n\n\n\n

In short, the Illinois Supreme Court concluded that the unsuccessful loan application allegations were not \u201cfairly traceable\u201d to any of the provider\u2019s alleged misconduct and instead were \u201cpurely speculative\u201d given there was \u201cno apparent connection between the purported fraudulent loan attempt and the data breach at issue\u201d as the phone number and city information used in the loan application was \u201creadily available\u201d to the public.  Id.<\/em>, \u00b6 25(citing 2023 IL App (5th) 220742, \u00b6 23).  Therefore, Plaintiff lacked standing to bring her claims.<\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

The Illinois Supreme Court\u2019s decision in Petta<\/em> is a win for companies that suffered a data breach only possibly affecting customers, informed the customers of the breach, and offered to pay for their credit monitoring.  Petta <\/em>shows that to confer standing under Illinois law, more is required.  Specifically, data breach plaintiffs need to identify actual injury fairly traceable to the breach.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Justin Donoho, and George J. Schaller Duane Morris Takeaways: On January 24, 2025, in Petta v. Christie Bus. Holdings Co., P.C., 2025 IL 130337, the Illinois Supreme Court ruled that a plaintiff lacked standing under Illinois law to bring her class action complaint alleging that her social security number and … <\/p>\n

Continue reading “Illinois Supreme Court Affirms Dismissal Of Data Breach Class Action For Lack Of Standing”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91],"tags":[],"ppma_author":[7,122,96],"class_list":["post-2005","post","type-post","status-publish","format-standard","hentry","category-data-breach-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":122,"user_id":686,"is_guest":0,"slug":"jrdonoho","display_name":"Justin Donoho","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/02\/donohojustin-1-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":96,"user_id":655,"is_guest":0,"slug":"gschaller","display_name":"George Schaller","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2023\/07\/schallergeorge-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2005"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2005\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2005"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}