Matt Dinerstein v. Google, LLC

In the

United States Court of Appeals

for the Seventh Circuit

____________________

No. 20-3134

MATT DINERSTEIN, individually and

on behalf of all others similarly situated,

Plaintiff-Appellant,

v.

GOOGLE, LLC; UNIVERSITY OF CHICAGO;

and UNIVERSITY OF CHICAGO MEDICAL CENTER;

Defendants-Appellees.

____________________

Appeal from the United States District Court for the

Northern District of Illinois, Eastern Division.

No. 19 C 4311 — Rebecca R. Pallmeyer, Chief Judge.

____________________

ARGUED SEPTEMBER 17, 2021 — DECIDED JULY 11, 2023

____________________

Before SYKES, Chief Judge, and FLAUM and KIRSCH, Circuit

Judges.

SYKES, Chief Judge. This class-action lawsuit arises from a

research collaboration between Google and the University of

Chicago together with its affiliated Medical Center. (We will

refer to the latter two as “the University” unless the context

2 No. 20-3134

requires otherwise.) Harnessing the power of artificial

intelligence, the research partners aspired to develop soft-

ware capable of anticipating patients’ future healthcare

needs. If successful, the software promised to reduce medi-

cal complications, eliminate unnecessary hospital stays, and,

ultimately, improve patients’ healthcare outcomes.

As an initial step in the research effort, the University de-

livered several years of anonymized patient medical records

to Google, thus supplying it with the information needed to

“train” the software’s algorithms. A Data Use Agreement

governed the transfer. Restricting Google’s use of the rec-

ords to a list of specific research-related activities, the

agreement expressly prohibited the company from attempt-

ing to identify any patient whose records were disclosed.

The anonymized electronic records subject to the agree-

ment included those of Matt Dinerstein, twice an inpatient at

the hospital during the period covered by the records disclo-

sure. Dinerstein sued Google and the University on behalf of

himself and a class of other patients whose anonymized

records were disclosed. He alleged several theories of liabil-

ity. He first claimed that the University had breached either

an express or an implied contract traceable to a privacy

notice he received and an authorization he signed upon each

admission to the Medical Center. Alternatively, he asserted a

claim for unjust enrichment. Citing the same notice and

authorization, he also alleged that the University had re-

neged on its promise of patient confidentiality and therefore

violated the Illinois Consumer Fraud and Deceptive Busi-

ness Practices Act, 815 ILL. COMP. STAT. 505/1 et seq. Against

Google, he asserted claims for unjust enrichment and tor-

tious interference with his contract with the University.

No. 20-3134 3

Finally, he brought a privacy claim against all defendants

based on allegations of intrusion upon seclusion.

The district judge dismissed the consumer-fraud claim

for lack of standing and the rest of the suit for failure to state

a claim. We agree with her decision to dismiss the case, but

our analysis begins and ends with standing. Dinerstein has

not adequately alleged standing to pursue any of his claims.

To sue in federal court, a plaintiff must plausibly allege (and

later prove) that he has suffered an injury in fact that is

concrete and particularized, actual or imminent, and tracea-

ble to the defendant’s conduct. The injuries Dinerstein

alleges lack plausibility, concreteness, or imminence (or

some combination of the three). Because the complaint fails

to plausibly allege an injury in fact, we affirm but modify the

judgment to reflect a jurisdictional dismissal for lack of

standing.

I. Background

Our factual account is drawn from Dinerstein’s amended

complaint. We begin with a description of his inpatient stays

at the University Medical Center—and more particularly,

the paperwork he received at the start of each admission.

Dinerstein alleges that he was first admitted to the Medical

Center on June 4, 2015, and was discharged three days later.

He was then readmitted on June 25, this time for a two-night

stay. Upon each admission Dinerstein received a Notice of

Privacy Practices detailing the University’s confidentiality

obligations and the circumstances in which it might use or

disclose patient medical information. Relevant here, the

notice stated that the University would obtain “written

permission” for the sale of such information. Patient permis-

sion was not required, however, for the University to use or

4 No. 20-3134

share the information in limited research-related circum-

stances. In addition to the notice, Dinerstein received and

signed an Admission and Outpatient Agreement and Au-

thorization. By doing so he affirmed that he understood that

his medical information might be shared for approved

research purposes and that if so, he would “not be entitled to

any compensation.” He further acknowledged that “all

efforts” would “be made to protect [his] privacy” and that

“any use of [his] medical information” would comply with

both the notice and “federal and state laws.”

During Dinerstein’s two hospital stays, the University

compiled records of his vital readings, medical procedures,

prescriptions, test results, and diagnoses. The records also

contained demographic information. After each discharge

from the hospital, the Medical Center maintained electronic

copies of his patient records.

Approximately two years after Dinerstein’s hospital vis-

its, Google announced that it had partnered with the Univer-

sity to research new healthcare technology. With the help of

machine learning, the research partners aspired to develop

predictive modeling software that would improve the ability

of medical providers to forecast their patients’ medical needs

and, in turn, to tailor subsequent medical care. As described

in promotional statements, the project had the potential to

prevent medical complications, reduce hospital visits, and

improve overall health and well-being. 1

1 Matt Wood, UChicago Medicine Collaborates with Google to Use Machine

Learning for Better Health Care, UCHICAGO MEDICINE (May 17, 2017),

https://www.uchicagomedicine.org/forefront/research-and-discoveries-

articles/uchicago-medicine-collaborates-with-google-to-use-machine-

learning-for-better-health-care.

No. 20-3134 5

To reliably predict medical outcomes, the models needed

extensive information from which to learn. The University

thus agreed to transfer to Google a large set of anonymized

patient medical records. A Data Use Agreement executed by

the partners in December 2016 governed the transfer. While

most of the agreement’s provisions are irrelevant for our

purposes, a few deserve mention. First, the agreement

contemplated that before disclosure the University would

strip the patient records of all direct identifying information

except the dates of medical events and services. Second, the

agreement delineated the records’ authorized uses. In par-

ticular, Google was permitted to use the records only to

identify key medical information, to develop predictive

models, and to assess the models’ efficacy. It could neither

disclose information from within the records nor use the

records in contravention of federal law. Most importantly,

the agreement strictly prohibited Google from using the

records “to identify any individual.” Third, if the parties’

research efforts proved successful, the agreement granted

the University a perpetual license to use the predictive

models for its own “internal non-commercial research

purposes.”

The batch of medical records covered by the Data Use

Agreement spanned several years. Specifically, the agree-

ment directed the University to transfer to Google anony-

mized records generated from all inpatient, outpatient, and

emergency adult-patient encounters between January 1,

2010, and June 30, 2016. Both of Dinerstein’s overnight stays

occurred in June 2015, so his medical records were included

in the set disclosed to Google. Dinerstein alleges that the

University never obtained his consent—written or other-

6 No. 20-3134

wise—for the third-party record disclosure. Nor did Google

seek permission to use his records.

Dinerstein filed suit against the University and Google

seeking damages and injunctive relief on behalf of himself

and a class of patients whose anonymized records were

disclosed. He raised seven claims for relief. Against the

University he alleged claims for breach of an express or an

implied contract premised on the notice he received and the

authorization he signed upon each admission to the Medical

Center. More to the point, Dinerstein alleged that in ex-

change for his payment and personal medical information,

the University had agreed to protect and secure his infor-

mation. By sharing it with Google, the University had failed

to uphold its end of the bargain. As an alternative to his

contract claims, Dinerstein sought damages for unjust

enrichment. He also alleged a claim for violation of the

Illinois Consumer Fraud and Deceptive Business Practices

Act. This statutory claim rested on the alleged broken prom-

ises, which Dinerstein asserted the University never intend-

ed to keep in the first place.

Turning to Google, Dinerstein alleged that the company

had tortiously interfered with his contract with the Universi-

ty. He also asserted a claim for unjust enrichment based on

the company’s receipt of valuable patient medical records.

Finally, Dinerstein brought a tort claim against Google and

the University for invasion of privacy. More specifically, he

alleged that they had intruded upon his seclusion by send-

ing and receiving his sensitive medical information.

Relevant to this last theory of liability, Dinerstein claimed

that while he was an inpatient at the Medical Center, he had

used a smartphone with geolocation capabilities. Because he

No. 20-3134 7

had also downloaded various Google apps, he alleged that

the phone granted the company access to his precise location

during every moment of his hospital stays. He further

alleged that if Google compared his location data with the

insufficiently anonymized patient records, it could easily

ascertain his identity and uncover “intimate private details”

in his medical histories. And he alleged that Google could do

the same thing with other class members’ geolocation data.

The defendants moved to dismiss under Rules 12(b)(1)

and (6) of the Federal Rules of Civil Procedure. They argued

that Dinerstein had not alleged a concrete injury to support

Article III standing and, alternatively, that he had not stated

a cognizable claim. The judge granted the motion, agreeing

primarily with the latter argument and dismissing the

complaint in its entirety.

On the standing issue, the judge construed Dinerstein’s

allegations about a lost benefit of the bargain as sufficient to

support standing to sue on the contract (and contract-

alternative) theories against both the University and Google.

Dinerstein v. Google, LLC, 484 F. Supp. 3d 561, 574 (N.D. Ill.

2020). She also reasoned that the allegations about an inva-

sion of privacy—in the form of a wrongful disclosure of his

private medical information—supported Dinerstein’s stand-

ing to sue for intrusion upon seclusion. Id. at 575. But the

judge dismissed the consumer-fraud claim for lack of stand-

ing because “[a] claim under [the Illinois Consumer Fraud

and Deceptive Business Practices Act] requires a showing of

actual damages,” which Dinerstein had not alleged. Id. at 579

(citing 815 ILL. COMP. STAT. 505/10a(a)).

Moving on, the judge dismissed the claims for breach of

contract—express or implied—for failure to state a cogniza-

8 No. 20-3134

ble claim because Dinerstein had not adequately pleaded

economic damages, a required element under Illinois law. Id.

at 590–93; FED. R. CIV. P. 12(b)(6). Next, the judge noted but

chose not to decide the question whether Dinerstein’s claim

for tortious interference with contract necessarily fell with

the other contract claims. Instead, she held that the claim

failed for a separate reason: Dinerstein had not sufficiently

pleaded that Google had intentionally caused the University’s

breach of contract. Id. at 593. (Intent is necessary to state a

claim of tortious interference with contract in Illinois. HPI

Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 545 N.E.2d

672, 676 (Ill. 1989).)

Turning to the privacy claim, the judge observed that

Dinerstein had recharacterized his original intrusion-upon-

seclusion claim as a novel tort claim for breach of medical

confidentiality, a theory not yet recognized in Illinois. The

judge thought it unlikely that the Illinois Supreme Court

would recognize such a claim, so she declined to permit

Dinerstein to pursue it in federal court. That left only the

unjust-enrichment claims. Because unjust enrichment is not

an independent cause of action in Illinois, the judge dis-

missed those claims as well. Dinerstein appealed.

II. Discussion

The dismissal order rests partly on a failure to allege

Article III standing but mostly on the judge’s conclusion that

Dinerstein failed to state a claim upon which relief can be

granted. Our review of either basis for dismissal is de novo.

Nowlin v. Pritzker, 34 F.4th 629, 632 (7th Cir. 2022). The

parties primarily focus on whether the amended complaint

satisfies the statutory and common-law pleading require-

ments particular to each claim. But the threshold question is

No. 20-3134 9

standing, which “is jurisdictional and cannot be waived.”

Nettles v. Midland Funding LLC, 983 F.3d 896, 899 (7th Cir.

2020).

Standing doctrine traces its origins to Article III of the

Constitution, which grants federal courts the power to

resolve “Cases” and “Controversies.” U.S. CONST. art. III, § 2.

The doctrine’s elements are well established and familiar. To

sue in federal court, a plaintiff must have suffered (1) a

concrete, particularized, and actual or imminent injury (an

“injury in fact”) (2) that is fairly traceable to the defendant

and (3) that is likely to be redressed by a favorable judicial

decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992).

“[A]t the pleading stage, the plaintiff must clearly … allege

facts demonstrating each element.” Spokeo, Inc. v. Robins,

578 U.S. 330, 338 (2016) (quotation marks omitted). Moreo-

ver, “standing is not dispensed in gross; rather, plaintiffs

must demonstrate standing for each claim that they press

and for each form of relief that they seek.” TransUnion LLC v.

Ramirez, 141 S. Ct. 2190, 2208 (2021).

Like many of our recent cases concerning Article III

standing, this one hinges on the injury-in-fact element, and

in particular, the concreteness and imminence requirements.

While the concreteness requirement examines the substance

of a plaintiff’s asserted injury, the imminence requirement

measures its likelihood. In other words, to provide a basis to

sue in federal court, an injury must exist “in both a qualita-

tive and [a] temporal sense.” Whitmore v. Arkansas, 495 U.S.

149, 155 (1990).

Starting with the qualitative aspect, “[a] concrete injury

must be de facto; that is, it must actually exist.” Spokeo,

578 U.S. at 340 (quotation marks omitted). Endorsing the

10 No. 20-3134

term’s “usual meaning,” the Supreme Court has described a

concrete injury as one that is “real[] and not abstract.” Id.

(quotation marks omitted). Both tangible and intangible

harms may fit the bill, even if tangible harms like “physical

or monetary injur[ies]” are perhaps more intuitively con-

crete. TransUnion, 141 S. Ct. at 2204. As the Court has ex-

plained, our task—especially when the plaintiff asserts an

intangible harm—is to assess whether the alleged injury has

“a close relationship to a harm traditionally recognized as

providing a basis for a lawsuit in American courts.” Id.

(quotation marks omitted). The inquiry asks whether the

plaintiff has “identified a close historical or common-law

analogue” for his asserted injury. Id. Put another way, when

reviewing a plaintiff’s alleged injury for concreteness,

“[h]istory and tradition remain our ever-present guides.”

Pierre v. Midland Credit Mgmt., Inc., 29 F.4th 934, 938 (7th Cir.

2022).

Imminence is more of an “elastic concept.” Lujan,

504 U.S. at 564 n.2. While it lacks a precise framework, the

basic function of the imminence requirement “is to ensure

that the alleged injury is not too speculative for Article III

purposes.” Id. Accordingly, a plaintiff who has not suffered

a past harm cannot simply rest on allegations that he may

suffer some “possible future injury,” Whitmore, 495 U.S. at

158, “at some indefinite future time,” Lujan, 504 U.S. at 564

n.2. His threatened injury instead must be “certainly impend-

ing” to satisfy Article III. Id. And importantly, while an

imminent risk of future harm may suffice to support stand-

ing to sue for prospective relief (i.e., an injunction), a claim for

damages requires a concrete harm that has in fact occurred.

TransUnion, 141 S. Ct. at 2210–11.

No. 20-3134 11

With these fundamental standing principles in mind, we

turn to the claims presented in this case. At the outset,

however, we note that Dinerstein omitted from his opening

brief any discussion about the claims for unjust enrichment

or breach of an implied contract. By doing so, he abandoned

these claims on appeal, and we need not consider them. See

White v. United States, 8 F.4th 547, 552 (7th Cir. 2021); see also

FED. R. APP. P. 28(a)(8)(A) (requiring that the appellant’s

brief include his “contentions and the reasons for them”).

What remains is the privacy claim, the claim for breach of an

express contract, the consumer-fraud claim, and the claim

for tortious interference with contract. We address each in

turn.

A. Privacy Claim

We begin with the alleged breach of privacy because the

asserted injury underlying this claim is common to all claims

that remain live on appeal. In other words, our resolution of

the standing issue on this claim necessarily resolves portions

of others, streamlining our discussion of the claims that

follow.

Before diving into the standing analysis, we must discern

what, exactly, Dinerstein’s privacy claim is. His complaint

characterizes the defendants’ conduct as a common-law

intrusion upon seclusion, which is potentially actionable

when the alleged tortfeasor “intentionally intrudes, physical-

ly or otherwise, upon the solitude or seclusion of another.”

RESTATEMENT (SECOND) OF TORTS § 652(B) (AM. LAW INST.

1977) [hereinafter RESTATEMENT]. The Illinois Supreme Court

has adopted this definition of the tort, describing the pur-

pose of the seclusion right as “protecting a person from

another’s prying into their physical boundaries or affairs.”

12 No. 20-3134

W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc.,

183 N.E.3d 47, 58 (Ill. 2021); see also Lovgren v. Citizens First

Nat’l Bank, 534 N.E.2d 987, 988–89 (Ill. 1989).

Apparently accepting that neither defendant’s conduct

fits the elements of this tort, Dinerstein abandoned his

intrusion-upon-seclusion theory below, as the district judge

noted. Dinerstein, 484 F. Supp. 3d at 594. In his response to

the defendants’ motion to dismiss, Dinerstein reframed his

privacy claim as a breach of medical confidentiality, a novel

cause of action that posits a common-law duty of medical

providers to maintain patient confidentiality. Several states

have recognized some variety of this tort. See, e.g., Lawson v.

Halpern-Reiss, 212 A.3d 1213, 1219 (Vt. 2019); Byrne v. Avery

Ctr. for Obstetrics & Gynecology, P.C., 175 A.3d 1, 17 (Conn.

2018); McCormick v. England, 494 S.E.2d 431, 437 (S.C. Ct.

App. 1997). But Illinois is not one of them. Dinerstein there-

fore invited the district judge, sitting in diversity, to hold

that the Illinois Supreme Court would recognize the tort

under Illinois law. See Zahn v. N. Am. Power & Gas, LLC,

815 F.3d 1082, 1087 (7th Cir. 2016) ([W]e must use our own

best judgment to estimate how the [Illinois] Supreme Court

would rule as to its law.” (quotation marks omitted)). As

we’ve noted, the judge declined that invitation. Dinerstein,

484 F. Supp. 3d at 595.

More importantly for our purposes, however, Dinerstein

has chosen to stick with the new version of his privacy claim

on appeal. He premises his privacy-related challenges

exclusively on the novel medical-confidentiality theory.

Following his lead, then, we focus our discussion of standing

on the reframed privacy theory.

No. 20-3134 13

Dinerstein presents his privacy injury in two forms, one

backward-looking and the other forward-looking. But

considered in either direction—past or future—his asserted

injury does not establish standing to sue.

1. Past Harm

We start with the backward-looking form of injury. Cru-

cially, Dinerstein does not allege that Google has already

used the disclosed patient records to discern his identity.

Instead he focuses on the conduct of the University, arguing

that the record transfer was itself an actionable invasion of

his medical privacy. This is so, Dinerstein asserts, regardless

of whether Google ever actually identifies him.

By referencing a common-law privacy invasion,

Dinerstein attempts to compare his asserted injury to a harm

“traditionally recognized as providing a basis for lawsuits in

American courts.” TransUnion, 141 S. Ct. at 2204. In other

words, he engages with the proper inquiry under the

Supreme Court’s recent standing caselaw. But as we’ve

explained, an “invasion of privacy” is not a standalone tort;

the term “encompasse[s] four theories of wrongdoing: intru-

sion upon seclusion, appropriation of a person’s name or

likeness, publicity given to private life, and publicity placing

a person in a false light.” Pucillo v. Nat’l Credit Sys., Inc.,

66 F.4th 634, 639–40 (7th Cir. 2023) (quoting Persinger v. Sw.

Credit Sys., L.P., 20 F.4th 1184, 1192 (7th Cir. 2021)); see also

RESTATEMENT §§ 652A–652E. And because TransUnion

requires us to nail down a particular common-law analogue,

we must assess whether any of the recognized privacy torts

is sufficiently analogous to Dinerstein’s asserted injury. If

not, no concrete harm. “No concrete harm, no standing.”

TransUnion, 141 S. Ct. at 2214.

14 No. 20-3134

Of the four traditional privacy tort theories, the closest

comparator to Dinerstein’s new theory is probably the tort of

publicity given to private life, which occurs when someone

“gives publicity” to a “highly offensive” matter “concerning

the private life of another” that “is not of legitimate concern

to the public.” RESTATEMENT § 652D. Yet Dinerstein has

identified no case in which a court has permitted a plaintiff

to bring a public-disclosure tort premised on the dissemina-

tion of anonymized information. 2 Indeed, while the relevant

caselaw is sparse, we’re skeptical that this alleged factual

scenario would give rise to any injury at all—let alone one

concrete enough to support Article III standing. See, e.g.,

Shulman v. Grp. W Prods., Inc., 955 P.2d 469, 489 n.12 (Cal.

1998) (“[C]omplete lack of identification or identifiability

would seemingly defeat a private facts claim, as there could

be no injury … .”); Harris ex rel. Harris v. Easton Publ’g Co.,

483 A.2d 1377, 1385 (Pa. 1984) (“Absent an ability to identify

the complainant, there can be no communication and hence,

no publicity.”); cf. Frobose v. Am. Sav. & Loan Ass’n, 152 F.3d

602, 618 (7th Cir. 1998) (rejecting a false-light claim because

the communication neither mentioned the plaintiff by name

nor made her “readily identifiable to the public”).

Resisting this conclusion, Dinerstein contends that the

University’s records were insufficiently anonymized. He

cites a presentation from the 2017 Google Cloud Next con-

ference by Dr. Samuel Volchenboum, the University’s

Associate Chief Research Informatics Officer. Dinerstein

argues that Dr. Volchenboum’s presentation highlighted

2 Nor has Dinerstein identified a case in which a court has permitted a

plaintiff to bring the novel claim of breach of medical confidentiality in

circumstances like these.

No. 20-3134 15

various deficiencies in the “typical de-identification pro-

cess.” 3 He contends that the process risks leaving identifying

clues like the patient’s age, place of residence, and family

relations scattered throughout the purportedly “de-

identified” medical records. According to Dinerstein, such

clues are routinely found in the treating physician’s “free-

text” clinical notes. If these clues are pieced together,

reidentification is supposedly simple.

But Dinerstein’s complaint omits any allegations linking

the so-called “typical de-identification process” described in

Dr. Volchenboum’s presentation to the University’s de-

identification process here. Put differently, just because some

de-identification processes might be deficient, we cannot

assume that the University’s process was necessarily so. To

the contrary, the complaint acknowledges that the chal-

lenged record transfer occurred pursuant to the Data Use

Agreement, which states that “the majority of [patient]

identifiers will be removed,” leaving only “actual dates of

[medical] service and events.” Dinerstein’s allegations of

insufficient anonymization therefore do not cross the plausi-

bility threshold. See Silha v. ACT, Inc., 807 F.3d 169, 174 (7th

Cir. 2015) (“[T]he Twombly-Iqbal facial plausibility require-

ment for pleading a claim is incorporated into the standard

for pleading subject matter jurisdiction.”).

Moreover, Dinerstein appears to concede that the Uni-

versity adequately discharged its de-identification obliga-

tion. Describing a jointly authored article from the

University and Google, the complaint states that although

3Google Cloud Tech, Sensitive Data Management for Collaborative Research

Clouds (Google Cloud Next '17), YOUTUBE (Mar. 9, 2017),

https://www.youtube.com/watch?v=7Si956MXhWQ.

16 No. 20-3134

“the [date stamps] from the University patients’ records

were maintained,” the records otherwise had been “de-

identified.” And aside from the date stamps, Dinerstein does

not pinpoint any information within the records that he

thinks should have been redacted and was not. Nor does he

allege that the date stamps alone were impermissibly identi-

fying. At most he alleges that some personally identifying

information “may have evaded redaction”—a hypothetical

that does not support his repeated but conclusory assertions

that the University’s records were insufficiently anony-

mized. “Such … bare assertion[s] of harm—unsupported by

any concrete details”—do not suffice to allege a plausible,

concrete injury. Nowlin, 34 F.4th at 633.

2. Risk of Future Harm

That brings us to Dinerstein’s allegations of a forward-

looking privacy injury. Unlike the backward-looking injury,

this injury turns on Google’s conduct—or more precisely, its

anticipated conduct. At bottom, Dinerstein worries that the

date stamps contained in the transferred medical records,

along with the geolocation and demographic data collected

from his smartphone apps, offer Google a “perfect formula-

tion of data points” for later reidentification. In other words,

the record transfer created a risk that he might someday be

reidentified.

To the extent that Dinerstein rests his claim for damages

on allegations of future risk, the argument is a nonstarter. In

TransUnion the Supreme Court clarified that unless a “risk of

future harm materializes,” a plaintiff may rely on an “immi-

nent and substantial” risk of harm only when “pursu[ing]

forward-looking, injunctive relief to prevent the harm from

occurring.” 141 S. Ct. at 2210–11 (emphasis added). Or as our

No. 20-3134 17

court has summarized: “A plaintiff seeking money damages

has standing to sue in federal court only for harms that have

in fact materialized.” Pierre, 29 F.4th at 938. Because

Dinerstein alleges no material harm arising from the alleged

risk of future reidentification, that future risk cannot support

standing to sue for damages.

The alleged risk does not support standing to sue for in-

junctive relief either, though for a different reason: the risk

Dinerstein alleges is not sufficiently imminent. To be sure,

Google possesses a wealth of data about most, if not all,

Americans. Yet Dinerstein ignores that the governing Data

Use Agreement expressly prohibited Google from using the

transferred medical records—either by themselves or in

tandem with data already in its possession—“to identify any

individual.” And even if the contractual obligation doesn’t

itself foreclose the risk of reidentification, Dinerstein has not

alleged that Google has taken any steps to identify him. Nor,

for that matter, does he allege that Google intends to do so.

Without any allegations to that effect, “we cannot simply

presume a material risk of concrete harm.” TransUnion,

141 S. Ct. at 2212 (quoting Ramirez v. TransUnion LLC,

951 F.3d 1008, 1040 (9th Cir. 2020) (opinion of McKeown, J.)).

The risk of future injury is thus nowhere near “certainly

impending”; it is too speculative to satisfy the imminence

requirement for a suit for injunctive relief in federal court.

Clapper v. Amnesty International USA, 568 U.S. 398 (2013),

supports this holding. In Clapper attorneys and human-rights

organizations raised constitutional challenges to § 1881a of

the Foreign Intelligence Surveillance Act, arguing that

individuals with whom they regularly communicated were

probable targets of foreign electronic surveillance under the

18 No. 20-3134

Act. Id. at 406. Because of the possibility of surveillance, the

plaintiffs claimed that their international communications

were likely to be incidentally “acquired under § 1881a at

some point in the future.” Id. at 407.

The Court rejected this alleged future injury as a basis for

standing, reasoning that it rested on multiple layers of

“highly speculative fear.” Id. at 410. In particular, the “chain

of contingencies”—specifically that (1) the government

would choose to target their foreign contacts pursuant to its

§ 1881a authority; (2) the government would succeed in both

securing the requisite authorization and intercepting the

targeted communications; and (3) the plaintiffs would be

parties to those communications—“d[id] not satisfy the

requirement that threatened injury must be certainly im-

pending.” Id. The plaintiffs had offered little more than

speculation and assumptions—and importantly, “no specific

facts”—that their communications would actually be ac-

quired. Id. at 412. So too here. Dinerstein has expressed only

a “highly speculative fear” that Google might, “at some

point in the future,” identify him. Id. at 407, 410.

Our decisions in Remijas v. Neiman Marcus Group, LLC,

794 F.3d 688 (7th Cir. 2015), and Lewert v. P.F. Chang’s China

Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), are not to the contra-

ry. As an initial matter, both predate TransUnion. While that

is not to say that they are no longer authoritative, it is to

recognize that TransUnion marked a shift in the Court’s

standing jurisprudence. But even on their own terms,

Remijas and Lewert do not help Dinerstein’s standing argu-

ment here. In both cases we held that the plaintiffs had

sufficiently alleged a substantial risk of future harm stem-

ming from breaches of their credit-card information. Remijas,

No. 20-3134 19

794 F.3d at 693–94; Lewert, 819 F.3d at 967. Motivating our

decisions was the common-sense observation that hackers

steal private credit-card information for a primary purpose:

“to make fraudulent charges or assume … consumers’

identities.” Remijas, 794 F.3d at 693; Lewert, 819 F.3d at 967.

Therefore, the plaintiffs’ allegations about a substantial risk

of future harm had “cross[ed] the line from conceivable to

plausible.” Lewert, 819 F.3d at 968 (quoting Bell Atl. Corp. v.

Twombly, 550 U.S. 544, 570 (2007)).

The same cannot be said here. Absent from this case is a

comparable indication—rooted in common sense or other-

wise—that Google’s primary purpose in obtaining the

medical records was to reidentify the University’s patients.

Indeed, the fact that Google explicitly agreed not “to identify

any individual” is enough to rule out the contention that the

threat of reidentification is certainly impending. Quite the

opposite; that contention is wholly speculative and implau-

sible. It cannot supply the basis for standing. 4

B. Contract Claim

Next we assess the alleged injuries underlying

Dinerstein’s claim for breach of an express contract, a claim

4 Even if Dinerstein’s asserted privacy injury—past or future—were

sufficient to support standing (it is not), we see no reason to disturb the

judge’s decision not to recognize a novel claim for breach of medical

confidentiality. Illinois courts have not yet weighed in on the issue, and

“it is not our role to break new ground in state law.” Roppo v. Travelers

Com. Ins. Co., 869 F.3d 568, 596 (7th Cir. 2017) (quoting Lopardo v. Fleming

Cos., 97 F.3d 921, 930 (7th Cir. 1996)). This is especially true with

“[i]nnovative state law claims,” which “should be brought in state

court.” Insolia v. Philip Morris Inc., 216 F.3d 596, 607 (7th Cir. 2000). But

because Dinerstein lacks standing, we have no need to address this issue.

20 No. 20-3134

he brings only against the University. Recall that Dinerstein

roots the University’s purported contractual duty in the

Notice of Privacy Practices he received and the Admission

and Outpatient Agreement and Authorization he signed

each time he was admitted to the Medical Center. He argues

that these documents contractually obligated the University

to safeguard his medical information. In his view, transfer-

ring his medical records to Google was a flagrant breach of

that obligation.

To support standing to bring this claim, Dinerstein as-

serts three injuries. The first stems from his interest in priva-

cy—i.e., the injury we’ve already addressed and deemed

insufficient to support standing. The second, presented in

two forms, is pecuniary: Dinerstein contends that he overpaid

the University for his medical treatment or, alternatively,

that the University underpaid him for the interest in his

medical records. The third is contractual: Dinerstein con-

tends that the University’s breach of contract is itself an

actionable concrete injury.

1. Pecuniary Harms

We turn first to Dinerstein’s alleged pecuniary injuries,

which the Supreme Court has described as “traditional

tangible harms” that “readily qualify as concrete injuries

under Article III.” TransUnion, 141 S. Ct. at 2204. Even if

concrete, however, Dinerstein’s allegations of injury must be

plausible “to survive dismissal for lack of standing.” Diedrich

v. Ocwen Loan Servicing, LLC, 839 F.3d 583, 588 (7th Cir. 2016)

(citing Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)); see also Silha,

807 F.3d at 174. While Dinerstein alleges both an overpay-

ment and underpayment theory of financial harm, neither is

plausible and neither supplies a basis for standing.

No. 20-3134 21

Dinerstein’s overpayment theory rests on allegations that

the medical care he (more precisely, his insurer) purchased

came bundled with a promise of medical confidentiality.

Because the University failed to deliver on that promise, he

contends that he was deprived of the full benefit of his

bargain. Not only that, he also would not have purchased

the University’s medical treatment had he known that it

intended to share his private health information.

This is not the first time we’ve confronted an argument

like this one. In Remijas, 794 F.3d at 694–95, and Lewert,

819 F.3d at 968, the plaintiffs argued that they had overpaid

Neiman Marcus and P.F. Chang’s, respectively, because the

companies had failed to protect their credit-card infor-

mation. While we did not outright reject the plaintiffs’

theories, we expressed serious skepticism. We described the

plaintiffs’ injuries in Remijas, for example, as “problematic.”

794 F.3d at 694. And in both cases we explained that courts

have not entertained the overpayment theory of injury

outside the product-liability context, and we saw no need to

extend it “beyond its current scope.” Lewert, 819 F.3d at 968;

Remijas, 794 F.3d at 695.

Dinerstein has not alleged a defect in his medical care,

and we again are not inclined to recognize the overpayment

theory outside the product-liability context. (In this case that

would require extending it “from a particular product to the

operation of [an] entire” medical facility. Remijas, 794 F.3d at

695.) Perhaps anticipating this doctrinal problem, Dinerstein

tries to distinguish Remijas and Lewert, arguing that the

overpayment theories in those cases were implausible

because the companies had not charged an extra fee for

credit-card transactions. In other words, the plaintiffs had

22 No. 20-3134

not paid for credit-card data security. But this case is no

different. It is wholly implausible—and Dinerstein alleges

nothing to the contrary—that the University charged a

discrete “patient-confidentiality fee.” Indeed, the fact that it

reserved the right to share patient medical information for

approved research purposes suggests exactly the opposite.

So too does the fact that Dinerstein signed a release stating

that he would “not be entitled to any compensation, regard-

less of the value of such research or any products or inven-

tions developed therefrom.”

Dinerstein’s most helpful case is from another circuit. In

Carlsen v. GameStop, Inc., 833 F.3d 903, 909 (8th Cir. 2016), the

Eighth Circuit held that the plaintiff had alleged an “actual”

financial injury “in an amount equal to the difference be-

tween the value of [what] he paid for and the value of [what]

he received, i.e., a [digital magazine] subscription with

compromised privacy protection.” As our decisions in

Remijas and Lewert make clear, we’re not inclined to extend

the overpayment theory of injury to novel contexts. Regard-

less, Carlsen is also distinguishable for the reason we just

mentioned: Dinerstein’s overpayment injury is particularly

implausible given his express agreement that his medical

information “may be used and shared for research.” And his

argument that he would not have paid for the University’s

medical services had he known otherwise is similarly im-

plausible.

We are even more skeptical of Dinerstein’s second pecu-

niary theory—that the unauthorized use of his medical

information conferred a financial benefit on the University to

which he is entitled. This financial benefit apparently came

in the form of the perpetual software license reserved for the

No. 20-3134 23

University in the Data Use Agreement. To remedy the

University’s unjust benefit, Dinerstein suggests that the

court could order disgorgement or “at least a reasonable

royalty.”

Putting aside the fact that Dinerstein agreed that he was

not entitled to compensation for the use of his medical

information, his asserted injury cannot supply a basis for

standing. As an initial matter, Illinois law does not grant a

patient a property interest in his medical records; they

instead belong to the medical provider. Young v. Murphy,

90 F.3d 1225, 1236 (7th Cir. 1996) (“While Illinois law permits

a patient to inspect and copy his records … , there is no basis

for concluding that this grants a property interest in those

records to the patient.”); Holtkamp Trucking Co. v. Fletcher,

932 N.E.2d 34, 43–44 (Ill. App. Ct. 2010).

Additionally, this standing theory is squarely foreclosed

by our caselaw. In Silha we held “that a plaintiff’s claim of

injury in fact cannot be based solely on a defendant’s gain; it

must be based on a plaintiff’s loss.” 807 F.3d at 174–75.

There, students who had taken standardized college admis-

sions tests alleged that the testing agencies had shared their

personal information with educational institutions. The

students had consented to information sharing, yet the

agencies had not disclosed that they had profited from what

was really a sale of the students’ information. Id. at 171.

While the complaint highlighted the agencies’ profits, miss-

ing was any allegation that the students had “lost anything

of value as a result of the alleged misconduct.” Id. at 175.

Because their claimed injury was “based solely on a gain” to

the agencies, we held that the students had not established

an injury in fact. Id.

24 No. 20-3134

So too here. Dinerstein has not alleged that the Universi-

ty’s use of his medical information somehow deprived him

of its economic value. And although Dinerstein attempts to

distinguish Silha by arguing that unlike him, the students

had consented to disclosure, nothing about our resolution of

the case turned on consent. Silha’s controlling principle—

that a plaintiff cannot base an injury in fact solely on the

defendant’s gain—likewise controls here. In sum, neither of

Dinerstein’s alleged pecuniary injuries establishes standing

to sue under Article III.

2. Breach of Contract

What’s left, then, is Dinerstein’s argument that a breach

of contract is itself a legally cognizable injury in fact. He

contends that common-law courts traditionally entertained

claims for breach of contract regardless of whether the

plaintiff alleged any harm beyond the breach itself. From

this he infers that an allegation of a breach of contract is

enough, without more, to support Article III standing. In his

view, our caselaw supports his interpretation, and the

Supreme Court’s recent standing cases, namely Spokeo and

TransUnion, do not disturb it.

Even if Dinerstein’s historical account is correct, we read

the Court’s recent standing cases differently. In TransUnion

the Court confirmed that “an injury in law is not an injury in

fact.” 141 S. Ct. at 2205. That statement itself might be

enough to resolve Dinerstein’s “breach-alone” standing

theory. Yet to explain why our view diverges from

Dinerstein’s and that of one of our sister circuits, some

additional unpacking is warranted.

No. 20-3134 25

As we’ve already discussed, establishing an injury in fact

requires a plaintiff to show that he has suffered a concrete

injury—one that is both “real” and “de facto” and that “actu-

ally exist[s].” Spokeo, 578 U.S. at 340. Refining the concrete-

ness requirement, the Court in TransUnion emphasized the

distinction between (1) the cause of action giving a plaintiff

the right to sue over a defendant’s legal infraction and

(2) the injury, if any, that he suffered as a result. 141 S. Ct. at

2205. To sue in federal court, a plaintiff must have both; a

suitable cause of action cannot save a plaintiff’s case if he has

suffered no harm. In other words, only a plaintiff who has

been “concretely harmed” by the defendant’s legal infraction

“may sue that private defendant over [it] in federal court.”

Id.

Applying these concepts here, Dinerstein cannot rest on

the University’s alleged breach of contract as a discrete de

facto injury supporting his standing to sue in federal court. It

is at most an injury in law, which we know from TransUnion

“is not an injury in fact.” Id. (emphasis added). As one

scholar put it:

The logic of Spokeo—that standing cannot rest

on violations of legal rights that do not result

in factual harms—extends to suits alleging

breach of contract. After all, contracts simply

establish legal rights. By Spokeo’s reasoning, a

plaintiff should not have standing to sue for

breach of contract if the breach does not result

in some additional factual harm.

F. Andrew Hessick, Standing and Contracts, 89 GEO. WASH. L.

REV. 298, 313 (2021). Slightly rephrased, Dinerstein cannot

simply allege a bare breach of contract, “divorced from any

26 No. 20-3134

concrete harm, and satisfy the injury-in-fact requirement of

Article III.” Spokeo, 578 U.S. at 341. Without an allegation

that the purported breach resulted in some concrete harm,

we lack the “freewheeling power” to hold the University

accountable for its alleged “legal infraction[].”Casillas v.

Madison Ave. Assocs., Inc., 926 F.3d 329, 332 (7th Cir. 2019).

Yet Dinerstein retorts that Spokeo and TransUnion are ir-

relevant to the standing question here because neither

addressed common-law claims like breach of contract. He

reads the cases to answer only whether (and if so, when)

Congress may “elevate to the status of legally cognizable” an

injury that was “previously inadequate in law.” TransUnion,

141 S. Ct. at 2204–05 (quoting Spokeo, 578 U.S. at 341). To be

sure, Spokeo and TransUnion did address and decide those

questions. But we read the standing principles expounded in

those cases to extend beyond the statutory context. The

Court’s opinion in TransUnion, for example, set out to an-

swer the broader question: “What makes a harm concrete for

purposes of Article III?” Id. at 2204. In answering that ques-

tion, the Court issued important and broadly applicable

statements, including those just mentioned, about the

boundaries of the federal judicial power. Fairly interpreted,

those statements apply to all asserted injuries, not just

statutory violations.

To give a few more examples of TransUnion’s capacious

language, the Court observed that where a “plaintiff has not

suffered any physical, monetary, or cognizable intangible

harm traditionally recognized as providing a basis for a

lawsuit in American courts,” his “lawsuit may not proceed.”

Id. at 2206. And it defended “the concrete-harm require-

ment” as “essential to the Constitution’s separation of

No. 20-3134 27

powers.” Id. at 2207. Article III does not empower federal

courts “to publicly opine on every legal question” or to

“exercise general legal oversight … of private entities.” Id. at

2203. Yet by asking us to weigh in on the University’s al-

leged breach of contract in the absence of any actual harm,

Dinerstein invites us to function “not as an Article III court,

but as a moot court,” and do exactly that. Uzuegbunam v.

Preczewski, 141 S. Ct. 792, 804 (2021) (Roberts, C.J., dissent-

ing). We decline the invitation. Taking up such matters “is,

by very definition, for a court to act ultra vires.” Steel Co. v.

Citizens for a Better Env’t, 523 U.S. 83, 102 (1998).

These general standing principles guided the Court as it

then considered when Congress may give a real-world

injury “actionable legal status.” TransUnion, 141 S. Ct. at

2205. And contrary to Dinerstein’s view, the Court’s framing

of this more specific question also supports our reading of its

recent caselaw. Rather than ask whether federal courts may

depart from established standing doctrine when Congress

has attempted to define an injury, in Spokeo and TransUnion

the Court explored when a congressionally defined injury

might satisfy the existing doctrine. The cases speak, for

example, about Congress’s lack of authority to “erase

Article III’s standing requirements,” Spokeo, 578 U.S. at 339

(quotation marks omitted), and about our obligation to

“independently decide whether a plaintiff has suffered a

concrete harm under Article III” notwithstanding Congress’s

creation of new statutory duties, TransUnion, 141 S. Ct. at

2205. Simply put, Spokeo and TransUnion established “fun-

damental standing principles,” id. at 2207, and those princi-

ples control this case.

28 No. 20-3134

If Spokeo and TransUnion leave any doubt about whether

a breach of contract is itself a concrete injury, Thole v. U.S.

Bank N.A., 140 S. Ct. 1615 (2020), resolves it. Thole involved

claims for breach of fiduciary duty under ERISA. Two

participants in a defined-benefit retirement plan sued the

bank contending that it had mismanaged the plan. But

crucially, they had sustained no monetary injury from the

mismanagement. Id. at 1618. The Supreme Court thus af-

firmed the Eighth Circuit’s dismissal for lack of standing and

in so doing rejected the participants’ attempted trust-law

analogy. “[A] defined-benefit plan,” the Court reasoned, “is

more in the nature of a contract. The plan participants’

benefits are fixed and will not change, regardless of how

well or poorly the plan is managed.” Id. at 1620 (emphasis

added). Because the Court held that the plan participants

nonetheless lacked standing to pursue their claims, we

understand Thole to imply that an alleged breach of contract,

without any corresponding actual harm, does not give rise to

an Article III case or controversy. 5

Nor are we persuaded by Dinerstein’s argument that the

Court’s instructions in Spokeo and TransUnion—that we must

compare the plaintiff’s asserted injury to harms traditionally

recognized at common law—resolves the standing question

here. As we understand the argument, he contends that

5 In fact, the dissent raised this precise point. Thole v. U.S. Bank N.A.,

140 S. Ct. 1615, 1630 (2020) (Sotomayor, J., dissenting) (reasoning that the

plan participants had standing because a “breach of contract always

creates a right of action, even when no financial harm was caused”

(quotation marks omitted)). That the majority was not persuaded by this

view further supports our conclusion that a breach of contract does not

by itself confer standing to sue.

No. 20-3134 29

because common-law courts allowed a plaintiff to vindicate

his contractual rights without a further showing of injury, he

need not allege anything aside from the University’s bare

breach of contract.

True, common-law courts historically heard contract cas-

es and awarded nominal damages even when the breach

either “caused no loss” or “the amount of the loss [wa]s not

proved.” RESTATEMENT (SECOND) OF CONTRACTS § 346(2) (AM.

LAW INST. 1981); see also Springer v. Cleveland Clinic Emp.

Health Plan Total Care, 900 F.3d 284, 292–93 (6th Cir. 2018)

(Thapar, J., concurring) (“[Common-law courts] entertained

breach-of-contract claims even when no real loss [could] be

prove[n]. Such violations at least deserved nominal damag-

es … .” (internal quotation marks omitted)). Yet “[t]he

requirements of Art[icle] III are not satisfied merely because

a party … has couched [his] request for forms of relief

historically associated with courts of law in terms that have a

familiar ring to those trained in the legal process.” Valley

Forge Christian Coll. v. Ams. United for Separation of Church &

State, Inc., 454 U.S. 464, 471 (1982).

More importantly, however, Spokeo and TransUnion put

an end to federal courts hearing claims premised on nonex-

istent injuries—regardless of historical pedigree.6 And the

Court’s recently announced “historical-analogue test” does

not suggest otherwise. That test asks whether a modern

injury bears a “close relationship” to a harm traditionally

6 See William Baude, Standing in the Shadow of Congress, 2016 S. CT. REV.

197, 217 (“[I]t is hard to see how nominal damages are fully consistent

with the logic of Spokeo. The very premise of nominal damages is that

one cannot show any ‘actual injury’ apart from the violation of the legal

right itself.” (citing Carey v. Piphus, 435 U.S. 247, 266 (1978))).

30 No. 20-3134

recognized by common-law courts. TransUnion, 141 S. Ct. at

2204. It does not, however, transform into a concrete factual

injury what the common law has historically regarded as a

legal injury. Put differently, a historical record is no talis-

man. It is necessary, but not sufficient, to satisfy the

Article III concreteness requirement.

Still, because Dinerstein views Spokeo, TransUnion, and

Thole as inapposite, he argues that our prior decision in J.P.

Morgan Chase Bank, N.A. v. McDonald, 760 F.3d 646 (7th Cir.

2014), binds us. Relevant here, at issue in J.P. Morgan was

whether a bank had standing to block an ongoing arbitration

proceeding that two investors had initiated after losing

approximately a quarter of their initial investment. The

contracts governing the investors’ accounts included a

forum-selection clause that required disputes to be brought

in either state or federal court. Id. at 649. Seeking to enforce

the forum-selection provision, the bank sued the investors in

federal court. After months of litigation, the judge dismissed

the bank’s claims for lack of standing. Id. at 650.

Reversing the dismissal, we held that the bank had

standing to enforce the clause. To form a bilateral contract,

each party must “take on one or more legally binding obliga-

tions,” we explained. Id. “When one party fails to honor its

commitments, the other party to the contract suffers a legal

injury sufficient to create standing even where that party

seems not to have incurred monetary loss or other concrete

harm.” Id. at 650–51. Because the bank had alleged that the

investors had “violated the terms of th[eir] bargain” by

selecting an improper dispute-resolution forum, it had

established standing to sue. Id. at 651.

No. 20-3134 31

Dinerstein understandably seizes on this favorable lan-

guage, but he omits the discussion that follows it. We went

on to explain in J.P. Morgan that the bank had “a very real

financial interest in the arbitration” because it was statutori-

ly and contractually obligated to “foot the bill” for the

resulting costs. Id. Given this independent financial interest,

the standing question was not merely “one of abstract

principle”; it was yet another reason why the bank had

standing to sue. Id.

The concrete harms present in J.P. Morgan—being hauled

into an improper forum and financing the resulting costs—

distinguish it from this case. Moreover, while those harms

prevent us from needing to revisit J.P. Morgan, we note that

some language in the opinion is in tension with the Supreme

Court’s recent decisions in Spokeo and TransUnion. No longer

is “a legal injury sufficient to create standing.” J.P. Morgan,

760 F.3d at 651. “[U]nder Article III, an injury in law is not

an injury in fact. Only those plaintiffs who have been con-

cretely harmed” by a defendant may sue in federal court.

TransUnion, 141 S. Ct. at 2205. Any portion of our opinion in

J.P. Morgan that suggests otherwise cannot control here.

Finally, we recognize that some tension also exists be-

tween our analysis here and that of a few of our sister cir-

cuits. There is no direct conflict, however. For starters, many

of the out-of-circuit decisions pointing in the other direction

predate TransUnion, a watershed decision on the standing

doctrine. See, e.g., Mitchell v. Blue Cross Blue Shield, 953 F.3d

529, 536 (8th Cir. 2020); Springer, 900 F.3d at 287; Katz v.

Pershing, LLC, 672 F.3d 64, 72 (1st Cir. 2012). Of the circuits to

consider the issue post-TransUnion, we understand one to

agree with our position, Perry v. Newsom, 18 F.4th 622, 632

32 No. 20-3134

(9th Cir. 2021) (“An analogy to a traditionally recognized

cause of action does not relieve a complainant of its burden

to demonstrate an injury.”); one to leave it unresolved,

Glennborough Homeowners Ass’n v. U.S. Postal Serv., 21 F.4th

410, 415–16 (6th Cir. 2021) (“We need not resolve these

thorny questions today … .”); and one to come out the other

way, Denning v. Bond Pharmacy, Inc., 50 F.4th 445, 451 (5th

Cir. 2022) (“[A] breach of contract is a sufficient injury for

standing purposes.”). But the Fifth Circuit’s opinion in

Denning did not engage with the logic of Spokeo and

TransUnion and rested in part on its own precedent. We

therefore do not understand the Fifth Circuit’s decision to

conflict with our own, nor are we inclined to adopt its

approach. As we read Thole, TransUnion, and Spokeo, a

breach of contract alone—without any actual harm—is

purely an injury in law, not an injury in fact. And it therefore

falls short of the Article III requirements for a suit in federal

court.

C. Remaining Claims

We need not spend much time addressing the tortious-

interference and consumer-fraud claims. Both rest on the

same allegations of a privacy, pecuniary, or contractual

injury that we’ve already examined and deemed insufficient

to confer standing.

Put simply, Dinerstein seeks to invoke the power of the

federal courts to challenge the lawfulness of an event that

caused him no harm. But federal courts do not offer “judicial

determination[s] that the plaintiffs’ interpretation of the law

is correct”; we resolve cases and controversies. Uzuegbunam,

141 S. Ct. at 804 (Roberts, C.J., dissenting). Because

Dinerstein has not alleged a plausible, concrete, and actual

No. 20-3134 33

or imminent injury to support his standing to sue, no such

case or controversy exists here. We accordingly modify the

judgment to reflect a jurisdictional dismissal for lack of

standing. As modified, the judgment is

AFFIRMED.