Matt Dinerstein , individually and on behalf of all others similarly situated v. GOOGLE, LLC; UNIVERSITY OF CHICAGO; and UNIVERSITY OF CHICAGO MEDICAL CENTER ;

In the
United States Court of Appeals
for the Seventh Circuit
____________________
No. 20-3134
M ATT DINERSTEIN , individually and
on behalf of all others similarly situated,
Plaintiff-Appellant,
v.
GOOGLE, LLC; U NIVERSITY OF C HICAGO;
and U NIVERSITY OF C HICAGO M EDICAL C ENTER ;
Defendants-Appellees.
____________________
Appeal from the United States District Court for the
Northern District of Illinois, Eastern Division.
No. 19 C 4311 — Rebecca R. Pallmeyer, Chief Judge.
____________________
A RGUED S EPTEMBER 17, 2021 — DECIDED J ULY 11, 2023
____________________
Before SYKES , Chief Judge, and F LAUM and K IRSCH , Circuit
Judges.
S YKES , Chief Judge. This class-action lawsuit arises from a
research collaboration between Google and the University of
Chicago together with its affiliated Medical Center. (We will
refer to the latter two as “the University” unless the context

-- 1 of 33 --

2 No. 20-3134
requires otherwise.) Harnessing the power of artificial
intelligence, the research partners aspired to develop soft-
ware capable of anticipating patients’ future healthcare
needs. If successful, the software promised to reduce medi-
cal complications, eliminate unnecessary hospital stays, and,
ultimately, improve patients’ healthcare outcomes.
As an initial step in the research effort, the University de-
livered several years of anonymized patient medical records
to Google, thus supplying it with the information needed to
“train” the software’s algorithms. A Data Use Agreement
governed the transfer. Restricting Google’s use of the rec-
ords to a list of specific research-related activities, the
agreement expressly prohibited the company from attempt-
ing to identify any patient whose records were disclosed.
The anonymized electronic records subject to the agree-
ment included those of Matt Dinerstein, twice an inpatient at
the hospital during the period covered by the records disclo-
sure. Dinerstein sued Google and the University on behalf of
himself and a class of other patients whose anonymized
records were disclosed. He alleged several theories of liabil-
ity. He first claimed that the University had breached either
an express or an implied contract traceable to a privacy
notice he received and an authorization he signed upon each
admission to the Medical Center. Alternatively, he asserted a
claim for unjust enrichment. Citing the same notice and
authorization, he also alleged that the University had re-
neged on its promise of patient confidentiality and therefore
violated the Illinois Consumer Fraud and Deceptive Busi-
ness Practices Act, 815 I LL. C OMP . S TAT. 505/1 et seq. Against
Google, he asserted claims for unjust enrichment and tor-
tious interference with his contract with the University.

-- 2 of 33 --

No. 20-3134 3
Finally, he brought a privacy claim against all defendants
based on allegations of intrusion upon seclusion.
The district judge dismissed the consumer-fraud claim
for lack of standing and the rest of the suit for failure to state
a claim. We agree with her decision to dismiss the case, but
our analysis begins and ends with standing. Dinerstein has
not adequately alleged standing to pursue any of his claims.
To sue in federal court, a plaintiff must plausibly allege (and
later prove) that he has suffered an injury in fact that is
concrete and particularized, actual or imminent, and tracea-
ble to the defendant’s conduct. The injuries Dinerstein
alleges lack plausibility, concreteness, or imminence (or
some combination of the three). Because the complaint fails
to plausibly allege an injury in fact, we affirm but modify the
judgment to reflect a jurisdictional dismissal for lack of
standing.
I. Background
Our factual account is drawn from Dinerstein’s amended
complaint. We begin with a description of his inpatient stays
at the University Medical Center—and more particularly,
the paperwork he received at the start of each admission.
Dinerstein alleges that he was first admitted to the Medical
Center on June 4, 2015, and was discharged three days later.
He was then readmitted on June 25, this time for a two-night
stay. Upon each admission Dinerstein received a Notice of
Privacy Practices detailing the University’s confidentiality
obligations and the circumstances in which it might use or
disclose patient medical information. Relevant here, the
notice stated that the University would obtain “written
permission” for the sale of such information. Patient permis-
sion was not required, however, for the University to use or

-- 3 of 33 --

4 No. 20-3134
share the information in limited research-related circum-
stances. In addition to the notice, Dinerstein received and
signed an Admission and Outpatient Agreement and Au-
thorization. By doing so he affirmed that he understood that
his medical information might be shared for approved
research purposes and that if so, he would “not be entitled to
any compensation.” He further acknowledged that “all
efforts” would “be made to protect [his] privacy” and that
“any use of [his] medical information” would comply with
both the notice and “federal and state laws.”
During Dinerstein’s two hospital stays, the University
compiled records of his vital readings, medical procedures,
prescriptions, test results, and diagnoses. The records also
contained demographic information. After each discharge
from the hospital, the Medical Center maintained electronic
copies of his patient records.
Approximately two years after Dinerstein’s hospital vis-
its, Google announced that it had partnered with the Univer-
sity to research new healthcare technology. With the help of
machine learning, the research partners aspired to develop
predictive modeling software that would improve the ability
of medical providers to forecast their patients’ medical needs
and, in turn, to tailor subsequent medical care. As described
in promotional statements, the project had the potential to
prevent medical complications, reduce hospital visits, and
improve overall health and well-being.1
1 Matt Wood, UChicago Medicine Collaborates with Google to Use Machine
Learning for Better Health Care, UC HICAGO M EDICINE (May 17, 2017),
https://www.uchicagomedicine.org/forefront/research-and-discoveries-
articles/uchicago-medicine-collaborates-with-google-to-use-machine-
learning-for-better-health-care.

-- 4 of 33 --

No. 20-3134 5
To reliably predict medical outcomes, the models needed
extensive information from which to learn. The University
thus agreed to transfer to Google a large set of anonymized
patient medical records. A Data Use Agreement executed by
the partners in December 2016 governed the transfer. While
most of the agreement’s provisions are irrelevant for our
purposes, a few deserve mention. First, the agreement
contemplated that before disclosure the University would
strip the patient records of all direct identifying information
except the dates of medical events and services. Second, the
agreement delineated the records’ authorized uses. In par-
ticular, Google was permitted to use the records only to
identify key medical information, to develop predictive
models, and to assess the models’ efficacy. It could neither
disclose information from within the records nor use the
records in contravention of federal law. Most importantly,
the agreement strictly prohibited Google from using the
records “to identify any individual.” Third, if the parties’
research efforts proved successful, the agreement granted
the University a perpetual license to use the predictive
models for its own “internal non-commercial research
purposes.”
The batch of medical records covered by the Data Use
Agreement spanned several years. Specifically, the agree-
ment directed the University to transfer to Google anony-
mized records generated from all inpatient, outpatient, and
emergency adult-patient encounters between January 1,
2010, and June 30, 2016. Both of Dinerstein’s overnight stays
occurred in June 2015, so his medical records were included
in the set disclosed to Google. Dinerstein alleges that the
University never obtained his consent—written or other-

-- 5 of 33 --

6 No. 20-3134
wise—for the third-party record disclosure. Nor did Google
seek permission to use his records.
Dinerstein filed suit against the University and Google
seeking damages and injunctive relief on behalf of himself
and a class of patients whose anonymized records were
disclosed. He raised seven claims for relief. Against the
University he alleged claims for breach of an express or an
implied contract premised on the notice he received and the
authorization he signed upon each admission to the Medical
Center. More to the point, Dinerstein alleged that in ex-
change for his payment and personal medical information,
the University had agreed to protect and secure his infor-
mation. By sharing it with Google, the University had failed
to uphold its end of the bargain. As an alternative to his
contract claims, Dinerstein sought damages for unjust
enrichment. He also alleged a claim for violation of the
Illinois Consumer Fraud and Deceptive Business Practices
Act. This statutory claim rested on the alleged broken prom-
ises, which Dinerstein asserted the University never intend-
ed to keep in the first place.
Turning to Google, Dinerstein alleged that the company
had tortiously interfered with his contract with the Universi-
ty. He also asserted a claim for unjust enrichment based on
the company’s receipt of valuable patient medical records.
Finally, Dinerstein brought a tort claim against Google and
the University for invasion of privacy. More specifically, he
alleged that they had intruded upon his seclusion by send-
ing and receiving his sensitive medical information.
Relevant to this last theory of liability, Dinerstein claimed
that while he was an inpatient at the Medical Center, he had
used a smartphone with geolocation capabilities. Because he

-- 6 of 33 --

No. 20-3134 7
had also downloaded various Google apps, he alleged that
the phone granted the company access to his precise location
during every moment of his hospital stays. He further
alleged that if Google compared his location data with the
insufficiently anonymized patient records, it could easily
ascertain his identity and uncover “intimate private details”
in his medical histories. And he alleged that Google could do
the same thing with other class members’ geolocation data.
The defendants moved to dismiss under Rules 12(b)(1)
and (6) of the Federal Rules of Civil Procedure. They argued
that Dinerstein had not alleged a concrete injury to support
Article III standing and, alternatively, that he had not stated
a cognizable claim. The judge granted the motion, agreeing
primarily with the latter argument and dismissing the
complaint in its entirety.
On the standing issue, the judge construed Dinerstein’s
allegations about a lost benefit of the bargain as sufficient to
support standing to sue on the contract (and contract-
alternative) theories against both the University and Google.
Dinerstein v. Google, LLC, 484 F. Supp. 3d 561, 574 (N.D. Ill.
2020). She also reasoned that the allegations about an inva-
sion of privacy—in the form of a wrongful disclosure of his
private medical information—supported Dinerstein’s stand-
ing to sue for intrusion upon seclusion. Id. at 575. But the
judge dismissed the consumer-fraud claim for lack of stand-
ing because “[a] claim under [the Illinois Consumer Fraud
and Deceptive Business Practices Act] requires a showing of
actual damages,” which Dinerstein had not alleged. Id. at 579
(citing 815 I LL. C OMP . S TAT. 505/10a(a)).
Moving on, the judge dismissed the claims for breach of
contract—express or implied—for failure to state a cogniza-

-- 7 of 33 --

8 No. 20-3134
ble claim because Dinerstein had not adequately pleaded
economic damages, a required element under Illinois law. Id.
at 590–93; F ED. R. CIV. P. 12(b)(6). Next, the judge noted but
chose not to decide the question whether Dinerstein’s claim
for tortious interference with contract necessarily fell with
the other contract claims. Instead, she held that the claim
failed for a separate reason: Dinerstein had not sufficiently
pleaded that Google had intentionally caused the University’s
breach of contract. Id. at 593. (Intent is necessary to state a
claim of tortious interference with contract in Illinois. HPI
Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 545 N.E.2d
672, 676 (Ill. 1989).)
Turning to the privacy claim, the judge observed that
Dinerstein had recharacterized his original intrusion-upon-
seclusion claim as a novel tort claim for breach of medical
confidentiality, a theory not yet recognized in Illinois. The
judge thought it unlikely that the Illinois Supreme Court
would recognize such a claim, so she declined to permit
Dinerstein to pursue it in federal court. That left only the
unjust-enrichment claims. Because unjust enrichment is not
an independent cause of action in Illinois, the judge dis-
missed those claims as well. Dinerstein appealed.
II. Discussion
The dismissal order rests partly on a failure to allege
Article III standing but mostly on the judge’s conclusion that
Dinerstein failed to state a claim upon which relief can be
granted. Our review of either basis for dismissal is de novo.
Nowlin v. Pritzker, 34 F.4th 629, 632 (7th Cir. 2022). The
parties primarily focus on whether the amended complaint
satisfies the statutory and common-law pleading require-
ments particular to each claim. But the threshold question is

-- 8 of 33 --

No. 20-3134 9
standing, which “is jurisdictional and cannot be waived.”
Nettles v. Midland Funding LLC, 983 F.3d 896, 899 (7th Cir.
2020).
Standing doctrine traces its origins to Article III of the
Constitution, which grants federal courts the power to
resolve “Cases” and “Controversies.” U.S. CONST. art. III, § 2.
The doctrine’s elements are well established and familiar. To
sue in federal court, a plaintiff must have suffered (1) a
concrete, particularized, and actual or imminent injury (an
“injury in fact”) (2) that is fairly traceable to the defendant
and (3) that is likely to be redressed by a favorable judicial
decision. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992).
“[A]t the pleading stage, the plaintiff must clearly … allege
facts demonstrating each element.” Spokeo, Inc. v. Robins,
578 U.S. 330, 338 (2016) (quotation marks omitted). Moreo-
ver, “standing is not dispensed in gross; rather, plaintiffs
must demonstrate standing for each claim that they press
and for each form of relief that they seek.” TransUnion LLC v.
Ramirez, 141 S. Ct. 2190, 2208 (2021).
Like many of our recent cases concerning Article III
standing, this one hinges on the injury-in-fact element, and
in particular, the concreteness and imminence requirements.
While the concreteness requirement examines the substance
of a plaintiff’s asserted injury, the imminence requirement
measures its likelihood. In other words, to provide a basis to
sue in federal court, an injury must exist “in both a qualita-
tive and [a] temporal sense.” Whitmore v. Arkansas, 495 U.S.
149, 155 (1990).
Starting with the qualitative aspect, “[a] concrete injury
must be de facto; that is, it must actually exist.” Spokeo,
578 U.S. at 340 (quotation marks omitted). Endorsing the

-- 9 of 33 --

10 No. 20-3134
term’s “usual meaning,” the Supreme Court has described a
concrete injury as one that is “real[] and not abstract.” Id.
(quotation marks omitted). Both tangible and intangible
harms may fit the bill, even if tangible harms like “physical
or monetary injur[ies]” are perhaps more intuitively con-
crete. TransUnion, 141 S. Ct. at 2204. As the Court has ex-
plained, our task—especially when the plaintiff asserts an
intangible harm—is to assess whether the alleged injury has
“a close relationship to a harm traditionally recognized as
providing a basis for a lawsuit in American courts.” Id.
(quotation marks omitted). The inquiry asks whether the
plaintiff has “identified a close historical or common-law
analogue” for his asserted injury. Id. Put another way, when
reviewing a plaintiff’s alleged injury for concreteness,
“[h]istory and tradition remain our ever-present guides.”
Pierre v. Midland Credit Mgmt., Inc., 29 F.4th 934, 938 (7th Cir.
2022).
Imminence is more of an “elastic concept.” Lujan,
504 U.S. at 564 n.2. While it lacks a precise framework, the
basic function of the imminence requirement “is to ensure
that the alleged injury is not too speculative for Article III
purposes.” Id. Accordingly, a plaintiff who has not suffered
a past harm cannot simply rest on allegations that he may
suffer some “possible future injury,” Whitmore, 495 U.S. at
158, “at some indefinite future time,” Lujan, 504 U.S. at 564
n.2. His threatened injury instead must be “certainly impend-
ing” to satisfy Article III. Id. And importantly, while an
imminent risk of future harm may suffice to support stand-
ing to sue for prospective relief (i.e., an injunction), a claim for
damages requires a concrete harm that has in fact occurred.
TransUnion, 141 S. Ct. at 2210–11.

-- 10 of 33 --

No. 20-3134 11
With these fundamental standing principles in mind, we
turn to the claims presented in this case. At the outset,
however, we note that Dinerstein omitted from his opening
brief any discussion about the claims for unjust enrichment
or breach of an implied contract. By doing so, he abandoned
these claims on appeal, and we need not consider them. See
White v. United States, 8 F.4th 547, 552 (7th Cir. 2021); see also
F ED. R. A PP . P. 28(a)(8)(A) (requiring that the appellant’s
brief include his “contentions and the reasons for them”).
What remains is the privacy claim, the claim for breach of an
express contract, the consumer-fraud claim, and the claim
for tortious interference with contract. We address each in
turn.
A. Privacy Claim
We begin with the alleged breach of privacy because the
asserted injury underlying this claim is common to all claims
that remain live on appeal. In other words, our resolution of
the standing issue on this claim necessarily resolves portions
of others, streamlining our discussion of the claims that
follow.
Before diving into the standing analysis, we must discern
what, exactly, Dinerstein’s privacy claim is. His complaint
characterizes the defendants’ conduct as a common-law
intrusion upon seclusion, which is potentially actionable
when the alleged tortfeasor “intentionally intrudes, physical-
ly or otherwise, upon the solitude or seclusion of another.”
R ESTATEMENT (S ECOND) OF TORTS § 652(B) (A M . LAW I NST.
1977) [hereinafter R ESTATEMENT]. The Illinois Supreme Court
has adopted this definition of the tort, describing the pur-
pose of the seclusion right as “protecting a person from
another’s prying into their physical boundaries or affairs.”

-- 11 of 33 --

12 No. 20-3134
W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc.,
183 N.E.3d 47, 58 (Ill. 2021); see also Lovgren v. Citizens First
Nat’l Bank, 534 N.E.2d 987, 988–89 (Ill. 1989).
Apparently accepting that neither defendant’s conduct
fits the elements of this tort, Dinerstein abandoned his
intrusion-upon-seclusion theory below, as the district judge
noted. Dinerstein, 484 F. Supp. 3d at 594. In his response to
the defendants’ motion to dismiss, Dinerstein reframed his
privacy claim as a breach of medical confidentiality, a novel
cause of action that posits a common-law duty of medical
providers to maintain patient confidentiality. Several states
have recognized some variety of this tort. See, e.g., Lawson v.
Halpern-Reiss, 212 A.3d 1213, 1219 (Vt. 2019); Byrne v. Avery
Ctr. for Obstetrics & Gynecology, P.C., 175 A.3d 1, 17 (Conn.
2018); McCormick v. England, 494 S.E.2d 431, 437 (S.C. Ct.
App. 1997). But Illinois is not one of them. Dinerstein there-
fore invited the district judge, sitting in diversity, to hold
that the Illinois Supreme Court would recognize the tort
under Illinois law. See Zahn v. N. Am. Power & Gas, LLC,
815 F.3d 1082, 1087 (7th Cir. 2016) ([W]e must use our own
best judgment to estimate how the [Illinois] Supreme Court
would rule as to its law.” (quotation marks omitted)). As
we’ve noted, the judge declined that invitation. Dinerstein,
484 F. Supp. 3d at 595.
More importantly for our purposes, however, Dinerstein
has chosen to stick with the new version of his privacy claim
on appeal. He premises his privacy-related challenges
exclusively on the novel medical-confidentiality theory.
Following his lead, then, we focus our discussion of standing
on the reframed privacy theory.

-- 12 of 33 --

No. 20-3134 13
Dinerstein presents his privacy injury in two forms, one
backward-looking and the other forward-looking. But
considered in either direction—past or future—his asserted
injury does not establish standing to sue.
1. Past Harm
We start with the backward-looking form of injury. Cru-
cially, Dinerstein does not allege that Google has already
used the disclosed patient records to discern his identity.
Instead he focuses on the conduct of the University, arguing
that the record transfer was itself an actionable invasion of
his medical privacy. This is so, Dinerstein asserts, regardless
of whether Google ever actually identifies him.
By referencing a common-law privacy invasion,
Dinerstein attempts to compare his asserted injury to a harm
“traditionally recognized as providing a basis for lawsuits in
American courts.” TransUnion, 141 S. Ct. at 2204. In other
words, he engages with the proper inquiry under the
Supreme Court’s recent standing caselaw. But as we’ve
explained, an “invasion of privacy” is not a standalone tort;
the term “encompasse[s] four theories of wrongdoing: intru-
sion upon seclusion, appropriation of a person’s name or
likeness, publicity given to private life, and publicity placing
a person in a false light.” Pucillo v. Nat’l Credit Sys., Inc.,
66 F.4th 634, 639–40 (7th Cir. 2023) (quoting Persinger v. Sw.
Credit Sys., L.P., 20 F.4th 1184, 1192 (7th Cir. 2021)); see also
R ESTATEMENT §§ 652A–652E. And because TransUnion
requires us to nail down a particular common-law analogue,
we must assess whether any of the recognized privacy torts
is sufficiently analogous to Dinerstein’s asserted injury. If
not, no concrete harm. “No concrete harm, no standing.”
TransUnion, 141 S. Ct. at 2214.

-- 13 of 33 --

14 No. 20-3134
Of the four traditional privacy tort theories, the closest
comparator to Dinerstein’s new theory is probably the tort of
publicity given to private life, which occurs when someone
“gives publicity” to a “highly offensive” matter “concerning
the private life of another” that “is not of legitimate concern
to the public.” R ESTATEMENT § 652D. Yet Dinerstein has
identified no case in which a court has permitted a plaintiff
to bring a public-disclosure tort premised on the dissemina-
tion of anonymized information.2 Indeed, while the relevant
caselaw is sparse, we’re skeptical that this alleged factual
scenario would give rise to any injury at all—let alone one
concrete enough to support Article III standing. See, e.g.,
Shulman v. Grp. W Prods., Inc., 955 P.2d 469, 489 n.12 (Cal.
1998) (“[C]omplete lack of identification or identifiability
would seemingly defeat a private facts claim, as there could
be no injury … .”); Harris ex rel. Harris v. Easton Publ’g Co.,
483 A.2d 1377, 1385 (Pa. 1984) (“Absent an ability to identify
the complainant, there can be no communication and hence,
no publicity.”); cf. Frobose v. Am. Sav. & Loan Ass’n, 152 F.3d
602, 618 (7th Cir. 1998) (rejecting a false-light claim because
the communication neither mentioned the plaintiff by name
nor made her “readily identifiable to the public”).
Resisting this conclusion, Dinerstein contends that the
University’s records were insufficiently anonymized. He
cites a presentation from the 2017 Google Cloud Next con-
ference by Dr. Samuel Volchenboum, the University’s
Associate Chief Research Informatics Officer. Dinerstein
argues that Dr. Volchenboum’s presentation highlighted
2 Nor has Dinerstein identified a case in which a court has permitted a
plaintiff to bring the novel claim of breach of medical confidentiality in
circumstances like these.

-- 14 of 33 --

No. 20-3134 15
various deficiencies in the “typical de-identification pro-
cess.”3 He contends that the process risks leaving identifying
clues like the patient’s age, place of residence, and family
relations scattered throughout the purportedly “de-
identified” medical records. According to Dinerstein, such
clues are routinely found in the treating physician’s “free-
text” clinical notes. If these clues are pieced together,
reidentification is supposedly simple.
But Dinerstein’s complaint omits any allegations linking
the so-called “typical de-identification process” described in
Dr. Volchenboum’s presentation to the University’s de-
identification process here. Put differently, just because some
de-identification processes might be deficient, we cannot
assume that the University’s process was necessarily so. To
the contrary, the complaint acknowledges that the chal-
lenged record transfer occurred pursuant to the Data Use
Agreement, which states that “the majority of [patient]
identifiers will be removed,” leaving only “actual dates of
[medical] service and events.” Dinerstein’s allegations of
insufficient anonymization therefore do not cross the plausi-
bility threshold. See Silha v. ACT, Inc., 807 F.3d 169, 174 (7th
Cir. 2015) (“[T]he Twombly-Iqbal facial plausibility require-
ment for pleading a claim is incorporated into the standard
for pleading subject matter jurisdiction.”).
Moreover, Dinerstein appears to concede that the Uni-
versity adequately discharged its de-identification obliga-
tion. Describing a jointly authored article from the
University and Google, the complaint states that although
3 Google Cloud Tech, Sensitive Data Management for Collaborative Research
Clouds (Google Cloud Next '17), YOUT UBE (Mar. 9, 2017),
https://www.youtube.com/watch?v=7Si956MXhWQ.

-- 15 of 33 --

16 No. 20-3134
“the [date stamps] from the University patients’ records
were maintained,” the records otherwise had been “de-
identified.” And aside from the date stamps, Dinerstein does
not pinpoint any information within the records that he
thinks should have been redacted and was not. Nor does he
allege that the date stamps alone were impermissibly identi-
fying. At most he alleges that some personally identifying
information “may have evaded redaction”—a hypothetical
that does not support his repeated but conclusory assertions
that the University’s records were insufficiently anony-
mized. “Such … bare assertion[s] of harm—unsupported by
any concrete details”—do not suffice to allege a plausible,
concrete injury. Nowlin, 34 F.4th at 633.
2. Risk of Future Harm
That brings us to Dinerstein’s allegations of a forward-
looking privacy injury. Unlike the backward-looking injury,
this injury turns on Google’s conduct—or more precisely, its
anticipated conduct. At bottom, Dinerstein worries that the
date stamps contained in the transferred medical records,
along with the geolocation and demographic data collected
from his smartphone apps, offer Google a “perfect formula-
tion of data points” for later reidentification. In other words,
the record transfer created a risk that he might someday be
reidentified.
To the extent that Dinerstein rests his claim for damages
on allegations of future risk, the argument is a nonstarter. In
TransUnion the Supreme Court clarified that unless a “risk of
future harm materializes,” a plaintiff may rely on an “immi-
nent and substantial” risk of harm only when “pursu[ing]
forward-looking, injunctive relief to prevent the harm from
occurring.” 141 S. Ct. at 2210–11 (emphasis added). Or as our

-- 16 of 33 --

No. 20-3134 17
court has summarized: “A plaintiff seeking money damages
has standing to sue in federal court only for harms that have
in fact materialized.” Pierre, 29 F.4th at 938. Because
Dinerstein alleges no material harm arising from the alleged
risk of future reidentification, that future risk cannot support
standing to sue for damages.
The alleged risk does not support standing to sue for in-
junctive relief either, though for a different reason: the risk
Dinerstein alleges is not sufficiently imminent. To be sure,
Google possesses a wealth of data about most, if not all,
Americans. Yet Dinerstein ignores that the governing Data
Use Agreement expressly prohibited Google from using the
transferred medical records—either by themselves or in
tandem with data already in its possession—“to identify any
individual.” And even if the contractual obligation doesn’t
itself foreclose the risk of reidentification, Dinerstein has not
alleged that Google has taken any steps to identify him. Nor,
for that matter, does he allege that Google intends to do so.
Without any allegations to that effect, “we cannot simply
presume a material risk of concrete harm.” TransUnion,
141 S. Ct. at 2212 (quoting Ramirez v. TransUnion LLC,
951 F.3d 1008, 1040 (9th Cir. 2020) (opinion of McKeown, J.)).
The risk of future injury is thus nowhere near “certainly
impending”; it is too speculative to satisfy the imminence
requirement for a suit for injunctive relief in federal court.
Clapper v. Amnesty International USA, 568 U.S. 398 (2013),
supports this holding. In Clapper attorneys and human-rights
organizations raised constitutional challenges to § 1881a of
the Foreign Intelligence Surveillance Act, arguing that
individuals with whom they regularly communicated were
probable targets of foreign electronic surveillance under the

-- 17 of 33 --

18 No. 20-3134
Act. Id. at 406. Because of the possibility of surveillance, the
plaintiffs claimed that their international communications
were likely to be incidentally “acquired under § 1881a at
some point in the future.” Id. at 407.
The Court rejected this alleged future injury as a basis for
standing, reasoning that it rested on multiple layers of
“highly speculative fear.” Id. at 410. In particular, the “chain
of contingencies”—specifically that (1) the government
would choose to target their foreign contacts pursuant to its
§ 1881a authority; (2) the government would succeed in both
securing the requisite authorization and intercepting the
targeted communications; and (3) the plaintiffs would be
parties to those communications—“d[id] not satisfy the
requirement that threatened injury must be certainly im-
pending.” Id. The plaintiffs had offered little more than
speculation and assumptions—and importantly, “no specific
facts”—that their communications would actually be ac-
quired. Id. at 412. So too here. Dinerstein has expressed only
a “highly speculative fear” that Google might, “at some
point in the future,” identify him. Id. at 407, 410.
Our decisions in Remijas v. Neiman Marcus Group, LLC,
794 F.3d 688 (7th Cir. 2015), and Lewert v. P.F. Chang’s China
Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), are not to the contra-
ry. As an initial matter, both predate TransUnion. While that
is not to say that they are no longer authoritative, it is to
recognize that TransUnion marked a shift in the Court’s
standing jurisprudence. But even on their own terms,
Remijas and Lewert do not help Dinerstein’s standing argu-
ment here. In both cases we held that the plaintiffs had
sufficiently alleged a substantial risk of future harm stem-
ming from breaches of their credit-card information. Remijas,

-- 18 of 33 --

No. 20-3134 19
794 F.3d at 693–94; Lewert, 819 F.3d at 967. Motivating our
decisions was the common-sense observation that hackers
steal private credit-card information for a primary purpose:
“to make fraudulent charges or assume … consumers’
identities.” Remijas, 794 F.3d at 693; Lewert, 819 F.3d at 967.
Therefore, the plaintiffs’ allegations about a substantial risk
of future harm had “cross[ed] the line from conceivable to
plausible.” Lewert, 819 F.3d at 968 (quoting Bell Atl. Corp. v.
Twombly, 550 U.S. 544, 570 (2007)).
The same cannot be said here. Absent from this case is a
comparable indication—rooted in common sense or other-
wise—that Google’s primary purpose in obtaining the
medical records was to reidentify the University’s patients.
Indeed, the fact that Google explicitly agreed not “to identify
any individual” is enough to rule out the contention that the
threat of reidentification is certainly impending. Quite the
opposite; that contention is wholly speculative and implau-
sible. It cannot supply the basis for standing.4
B. Contract Claim
Next we assess the alleged injuries underlying
Dinerstein’s claim for breach of an express contract, a claim
4 Even if Dinerstein’s asserted privacy injury—past or future—were
sufficient to support standing (it is not), we see no reason to disturb the
judge’s decision not to recognize a novel claim for breach of medical
confidentiality. Illinois courts have not yet weighed in on the issue, and
“it is not our role to break new ground in state law.” Roppo v. Travelers
Com. Ins. Co., 869 F.3d 568, 596 (7th Cir. 2017) (quoting Lopardo v. Fleming
Cos., 97 F.3d 921, 930 (7th Cir. 1996)). This is especially true with
“[i]nnovative state law claims,” which “should be brought in state
court.” Insolia v. Philip Morris Inc., 216 F.3d 596, 607 (7th Cir. 2000). But
because Dinerstein lacks standing, we have no need to address this issue.

-- 19 of 33 --

20 No. 20-3134
he brings only against the University. Recall that Dinerstein
roots the University’s purported contractual duty in the
Notice of Privacy Practices he received and the Admission
and Outpatient Agreement and Authorization he signed
each time he was admitted to the Medical Center. He argues
that these documents contractually obligated the University
to safeguard his medical information. In his view, transfer-
ring his medical records to Google was a flagrant breach of
that obligation.
To support standing to bring this claim, Dinerstein as-
serts three injuries. The first stems from his interest in priva-
cy—i.e., the injury we’ve already addressed and deemed
insufficient to support standing. The second, presented in
two forms, is pecuniary: Dinerstein contends that he overpaid
the University for his medical treatment or, alternatively,
that the University underpaid him for the interest in his
medical records. The third is contractual: Dinerstein con-
tends that the University’s breach of contract is itself an
actionable concrete injury.
1. Pecuniary Harms
We turn first to Dinerstein’s alleged pecuniary injuries,
which the Supreme Court has described as “traditional
tangible harms” that “readily qualify as concrete injuries
under Article III.” TransUnion, 141 S. Ct. at 2204. Even if
concrete, however, Dinerstein’s allegations of injury must be
plausible “to survive dismissal for lack of standing.” Diedrich
v. Ocwen Loan Servicing, LLC, 839 F.3d 583, 588 (7th Cir. 2016)
(citing Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)); see also Silha,
807 F.3d at 174. While Dinerstein alleges both an overpay-
ment and underpayment theory of financial harm, neither is
plausible and neither supplies a basis for standing.

-- 20 of 33 --

No. 20-3134 21
Dinerstein’s overpayment theory rests on allegations that
the medical care he (more precisely, his insurer) purchased
came bundled with a promise of medical confidentiality.
Because the University failed to deliver on that promise, he
contends that he was deprived of the full benefit of his
bargain. Not only that, he also would not have purchased
the University’s medical treatment had he known that it
intended to share his private health information.
This is not the first time we’ve confronted an argument
like this one. In Remijas, 794 F.3d at 694–95, and Lewert,
819 F.3d at 968, the plaintiffs argued that they had overpaid
Neiman Marcus and P.F. Chang’s, respectively, because the
companies had failed to protect their credit-card infor-
mation. While we did not outright reject the plaintiffs’
theories, we expressed serious skepticism. We described the
plaintiffs’ injuries in Remijas, for example, as “problematic.”
794 F.3d at 694. And in both cases we explained that courts
have not entertained the overpayment theory of injury
outside the product-liability context, and we saw no need to
extend it “beyond its current scope.” Lewert, 819 F.3d at 968;
Remijas, 794 F.3d at 695.
Dinerstein has not alleged a defect in his medical care,
and we again are not inclined to recognize the overpayment
theory outside the product-liability context. (In this case that
would require extending it “from a particular product to the
operation of [an] entire” medical facility. Remijas, 794 F.3d at
695.) Perhaps anticipating this doctrinal problem, Dinerstein
tries to distinguish Remijas and Lewert, arguing that the
overpayment theories in those cases were implausible
because the companies had not charged an extra fee for
credit-card transactions. In other words, the plaintiffs had

-- 21 of 33 --

22 No. 20-3134
not paid for credit-card data security. But this case is no
different. It is wholly implausible—and Dinerstein alleges
nothing to the contrary—that the University charged a
discrete “patient-confidentiality fee.” Indeed, the fact that it
reserved the right to share patient medical information for
approved research purposes suggests exactly the opposite.
So too does the fact that Dinerstein signed a release stating
that he would “not be entitled to any compensation, regard-
less of the value of such research or any products or inven-
tions developed therefrom.”
Dinerstein’s most helpful case is from another circuit. In
Carlsen v. GameStop, Inc., 833 F.3d 903, 909 (8th Cir. 2016), the
Eighth Circuit held that the plaintiff had alleged an “actual”
financial injury “in an amount equal to the difference be-
tween the value of [what] he paid for and the value of [what]
he received, i.e., a [digital magazine] subscription with
compromised privacy protection.” As our decisions in
Remijas and Lewert make clear, we’re not inclined to extend
the overpayment theory of injury to novel contexts. Regard-
less, Carlsen is also distinguishable for the reason we just
mentioned: Dinerstein’s overpayment injury is particularly
implausible given his express agreement that his medical
information “may be used and shared for research.” And his
argument that he would not have paid for the University’s
medical services had he known otherwise is similarly im-
plausible.
We are even more skeptical of Dinerstein’s second pecu-
niary theory—that the unauthorized use of his medical
information conferred a financial benefit on the University to
which he is entitled. This financial benefit apparently came
in the form of the perpetual software license reserved for the

-- 22 of 33 --

No. 20-3134 23
University in the Data Use Agreement. To remedy the
University’s unjust benefit, Dinerstein suggests that the
court could order disgorgement or “at least a reasonable
royalty.”
Putting aside the fact that Dinerstein agreed that he was
not entitled to compensation for the use of his medical
information, his asserted injury cannot supply a basis for
standing. As an initial matter, Illinois law does not grant a
patient a property interest in his medical records; they
instead belong to the medical provider. Young v. Murphy,
90 F.3d 1225, 1236 (7th Cir. 1996) (“While Illinois law permits
a patient to inspect and copy his records … , there is no basis
for concluding that this grants a property interest in those
records to the patient.”); Holtkamp Trucking Co. v. Fletcher,
932 N.E.2d 34, 43–44 (Ill. App. Ct. 2010).
Additionally, this standing theory is squarely foreclosed
by our caselaw. In Silha we held “that a plaintiff’s claim of
injury in fact cannot be based solely on a defendant’s gain; it
must be based on a plaintiff’s loss.” 807 F.3d at 174–75.
There, students who had taken standardized college admis-
sions tests alleged that the testing agencies had shared their
personal information with educational institutions. The
students had consented to information sharing, yet the
agencies had not disclosed that they had profited from what
was really a sale of the students’ information. Id. at 171.
While the complaint highlighted the agencies’ profits, miss-
ing was any allegation that the students had “lost anything
of value as a result of the alleged misconduct.” Id. at 175.
Because their claimed injury was “based solely on a gain” to
the agencies, we held that the students had not established
an injury in fact. Id.

-- 23 of 33 --

24 No. 20-3134
So too here. Dinerstein has not alleged that the Universi-
ty’s use of his medical information somehow deprived him
of its economic value. And although Dinerstein attempts to
distinguish Silha by arguing that unlike him, the students
had consented to disclosure, nothing about our resolution of
the case turned on consent. Silha’s controlling principle—
that a plaintiff cannot base an injury in fact solely on the
defendant’s gain—likewise controls here. In sum, neither of
Dinerstein’s alleged pecuniary injuries establishes standing
to sue under Article III.
2. Breach of Contract
What’s left, then, is Dinerstein’s argument that a breach
of contract is itself a legally cognizable injury in fact. He
contends that common-law courts traditionally entertained
claims for breach of contract regardless of whether the
plaintiff alleged any harm beyond the breach itself. From
this he infers that an allegation of a breach of contract is
enough, without more, to support Article III standing. In his
view, our caselaw supports his interpretation, and the
Supreme Court’s recent standing cases, namely Spokeo and
TransUnion, do not disturb it.
Even if Dinerstein’s historical account is correct, we read
the Court’s recent standing cases differently. In TransUnion
the Court confirmed that “an injury in law is not an injury in
fact.” 141 S. Ct. at 2205. That statement itself might be
enough to resolve Dinerstein’s “breach-alone” standing
theory. Yet to explain why our view diverges from
Dinerstein’s and that of one of our sister circuits, some
additional unpacking is warranted.

-- 24 of 33 --

No. 20-3134 25
As we’ve already discussed, establishing an injury in fact
requires a plaintiff to show that he has suffered a concrete
injury—one that is both “real” and “de facto” and that “actu-
ally exist[s].” Spokeo, 578 U.S. at 340. Refining the concrete-
ness requirement, the Court in TransUnion emphasized the
distinction between (1) the cause of action giving a plaintiff
the right to sue over a defendant’s legal infraction and
(2) the injury, if any, that he suffered as a result. 141 S. Ct. at
2205. To sue in federal court, a plaintiff must have both; a
suitable cause of action cannot save a plaintiff’s case if he has
suffered no harm. In other words, only a plaintiff who has
been “concretely harmed” by the defendant’s legal infraction
“may sue that private defendant over [it] in federal court.”
Id.
Applying these concepts here, Dinerstein cannot rest on
the University’s alleged breach of contract as a discrete de
facto injury supporting his standing to sue in federal court. It
is at most an injury in law, which we know from TransUnion
“is not an injury in fact.” Id. (emphasis added). As one
scholar put it:
The logic of Spokeo—that standing cannot rest
on violations of legal rights that do not result
in factual harms—extends to suits alleging
breach of contract. After all, contracts simply
establish legal rights. By Spokeo’s reasoning, a
plaintiff should not have standing to sue for
breach of contract if the breach does not result
in some additional factual harm.
F. Andrew Hessick, Standing and Contracts, 89 GEO. WASH . L.
R EV. 298, 313 (2021). Slightly rephrased, Dinerstein cannot
simply allege a bare breach of contract, “divorced from any

-- 25 of 33 --

26 No. 20-3134
concrete harm, and satisfy the injury-in-fact requirement of
Article III.” Spokeo, 578 U.S. at 341. Without an allegation
that the purported breach resulted in some concrete harm,
we lack the “freewheeling power” to hold the University
accountable for its alleged “legal infraction[].”Casillas v.
Madison Ave. Assocs., Inc., 926 F.3d 329, 332 (7th Cir. 2019).
Yet Dinerstein retorts that Spokeo and TransUnion are ir-
relevant to the standing question here because neither
addressed common-law claims like breach of contract. He
reads the cases to answer only whether (and if so, when)
Congress may “elevate to the status of legally cognizable” an
injury that was “previously inadequate in law.” TransUnion,
141 S. Ct. at 2204–05 (quoting Spokeo, 578 U.S. at 341). To be
sure, Spokeo and TransUnion did address and decide those
questions. But we read the standing principles expounded in
those cases to extend beyond the statutory context. The
Court’s opinion in TransUnion, for example, set out to an-
swer the broader question: “What makes a harm concrete for
purposes of Article III?” Id. at 2204. In answering that ques-
tion, the Court issued important and broadly applicable
statements, including those just mentioned, about the
boundaries of the federal judicial power. Fairly interpreted,
those statements apply to all asserted injuries, not just
statutory violations.
To give a few more examples of TransUnion’s capacious
language, the Court observed that where a “plaintiff has not
suffered any physical, monetary, or cognizable intangible
harm traditionally recognized as providing a basis for a
lawsuit in American courts,” his “lawsuit may not proceed.”
Id. at 2206. And it defended “the concrete-harm require-
ment” as “essential to the Constitution’s separation of

-- 26 of 33 --

No. 20-3134 27
powers.” Id. at 2207. Article III does not empower federal
courts “to publicly opine on every legal question” or to
“exercise general legal oversight … of private entities.” Id. at
2203. Yet by asking us to weigh in on the University’s al-
leged breach of contract in the absence of any actual harm,
Dinerstein invites us to function “not as an Article III court,
but as a moot court,” and do exactly that. Uzuegbunam v.
Preczewski, 141 S. Ct. 792, 804 (2021) (Roberts, C.J., dissent-
ing). We decline the invitation. Taking up such matters “is,
by very definition, for a court to act ultra vires.” Steel Co. v.
Citizens for a Better Env’t, 523 U.S. 83, 102 (1998).
These general standing principles guided the Court as it
then considered when Congress may give a real-world
injury “actionable legal status.” TransUnion, 141 S. Ct. at
2205. And contrary to Dinerstein’s view, the Court’s framing
of this more specific question also supports our reading of its
recent caselaw. Rather than ask whether federal courts may
depart from established standing doctrine when Congress
has attempted to define an injury, in Spokeo and TransUnion
the Court explored when a congressionally defined injury
might satisfy the existing doctrine. The cases speak, for
example, about Congress’s lack of authority to “erase
Article III’s standing requirements,” Spokeo, 578 U.S. at 339
(quotation marks omitted), and about our obligation to
“independently decide whether a plaintiff has suffered a
concrete harm under Article III” notwithstanding Congress’s
creation of new statutory duties, TransUnion, 141 S. Ct. at
2205. Simply put, Spokeo and TransUnion established “fun-
damental standing principles,” id. at 2207, and those princi-
ples control this case.

-- 27 of 33 --

28 No. 20-3134
If Spokeo and TransUnion leave any doubt about whether
a breach of contract is itself a concrete injury, Thole v. U.S.
Bank N.A., 140 S. Ct. 1615 (2020), resolves it. Thole involved
claims for breach of fiduciary duty under ERISA. Two
participants in a defined-benefit retirement plan sued the
bank contending that it had mismanaged the plan. But
crucially, they had sustained no monetary injury from the
mismanagement. Id. at 1618. The Supreme Court thus af-
firmed the Eighth Circuit’s dismissal for lack of standing and
in so doing rejected the participants’ attempted trust-law
analogy. “[A] defined-benefit plan,” the Court reasoned, “is
more in the nature of a contract. The plan participants’
benefits are fixed and will not change, regardless of how
well or poorly the plan is managed.” Id. at 1620 (emphasis
added). Because the Court held that the plan participants
nonetheless lacked standing to pursue their claims, we
understand Thole to imply that an alleged breach of contract,
without any corresponding actual harm, does not give rise to
an Article III case or controversy.5
Nor are we persuaded by Dinerstein’s argument that the
Court’s instructions in Spokeo and TransUnion—that we must
compare the plaintiff’s asserted injury to harms traditionally
recognized at common law—resolves the standing question
here. As we understand the argument, he contends that
5 In fact, the dissent raised this precise point. Thole v. U.S. Bank N.A.,
140 S. Ct. 1615, 1630 (2020) (Sotomayor, J., dissenting) (reasoning that the
plan participants had standing because a “breach of contract always
creates a right of action, even when no financial harm was caused”
(quotation marks omitted)). That the majority was not persuaded by this
view further supports our conclusion that a breach of contract does not
by itself confer standing to sue.

-- 28 of 33 --

No. 20-3134 29
because common-law courts allowed a plaintiff to vindicate
his contractual rights without a further showing of injury, he
need not allege anything aside from the University’s bare
breach of contract.
True, common-law courts historically heard contract cas-
es and awarded nominal damages even when the breach
either “caused no loss” or “the amount of the loss [wa]s not
proved.” R ESTATEMENT (S ECOND) OF C ONTRACTS § 346(2) (A M .
LAW I NST. 1981); see also Springer v. Cleveland Clinic Emp.
Health Plan Total Care, 900 F.3d 284, 292–93 (6th Cir. 2018)
(Thapar, J., concurring) (“[Common-law courts] entertained
breach-of-contract claims even when no real loss [could] be
prove[n]. Such violations at least deserved nominal damag-
es … .” (internal quotation marks omitted)). Yet “[t]he
requirements of Art[icle] III are not satisfied merely because
a party … has couched [his] request for forms of relief
historically associated with courts of law in terms that have a
familiar ring to those trained in the legal process.” Valley
Forge Christian Coll. v. Ams. United for Separation of Church &
State, Inc., 454 U.S. 464, 471 (1982).
More importantly, however, Spokeo and TransUnion put
an end to federal courts hearing claims premised on nonex-
istent injuries—regardless of historical pedigree.6 And the
Court’s recently announced “historical-analogue test” does
not suggest otherwise. That test asks whether a modern
injury bears a “close relationship” to a harm traditionally
6 See William Baude, Standing in the Shadow of Congress, 2016 S. C T. REV.
197, 217 (“[I]t is hard to see how nominal damages are fully consistent
with the logic of Spokeo. The very premise of nominal damages is that
one cannot show any ‘actual injury’ apart from the violation of the legal
right itself.” (citing Carey v. Piphus, 435 U.S. 247, 266 (1978))).

-- 29 of 33 --

30 No. 20-3134
recognized by common-law courts. TransUnion, 141 S. Ct. at
2204. It does not, however, transform into a concrete factual
injury what the common law has historically regarded as a
legal injury. Put differently, a historical record is no talis-
man. It is necessary, but not sufficient, to satisfy the
Article III concreteness requirement.
Still, because Dinerstein views Spokeo, TransUnion, and
Thole as inapposite, he argues that our prior decision in J.P.
Morgan Chase Bank, N.A. v. McDonald, 760 F.3d 646 (7th Cir.
2014), binds us. Relevant here, at issue in J.P. Morgan was
whether a bank had standing to block an ongoing arbitration
proceeding that two investors had initiated after losing
approximately a quarter of their initial investment. The
contracts governing the investors’ accounts included a
forum-selection clause that required disputes to be brought
in either state or federal court. Id. at 649. Seeking to enforce
the forum-selection provision, the bank sued the investors in
federal court. After months of litigation, the judge dismissed
the bank’s claims for lack of standing. Id. at 650.
Reversing the dismissal, we held that the bank had
standing to enforce the clause. To form a bilateral contract,
each party must “take on one or more legally binding obliga-
tions,” we explained. Id. “When one party fails to honor its
commitments, the other party to the contract suffers a legal
injury sufficient to create standing even where that party
seems not to have incurred monetary loss or other concrete
harm.” Id. at 650–51. Because the bank had alleged that the
investors had “violated the terms of th[eir] bargain” by
selecting an improper dispute-resolution forum, it had
established standing to sue. Id. at 651.

-- 30 of 33 --

No. 20-3134 31
Dinerstein understandably seizes on this favorable lan-
guage, but he omits the discussion that follows it. We went
on to explain in J.P. Morgan that the bank had “a very real
financial interest in the arbitration” because it was statutori-
ly and contractually obligated to “foot the bill” for the
resulting costs. Id. Given this independent financial interest,
the standing question was not merely “one of abstract
principle”; it was yet another reason why the bank had
standing to sue. Id.
The concrete harms present in J.P. Morgan—being hauled
into an improper forum and financing the resulting costs—
distinguish it from this case. Moreover, while those harms
prevent us from needing to revisit J.P. Morgan, we note that
some language in the opinion is in tension with the Supreme
Court’s recent decisions in Spokeo and TransUnion. No longer
is “a legal injury sufficient to create standing.” J.P. Morgan,
760 F.3d at 651. “[U]nder Article III, an injury in law is not
an injury in fact. Only those plaintiffs who have been con-
cretely harmed” by a defendant may sue in federal court.
TransUnion, 141 S. Ct. at 2205. Any portion of our opinion in
J.P. Morgan that suggests otherwise cannot control here.
Finally, we recognize that some tension also exists be-
tween our analysis here and that of a few of our sister cir-
cuits. There is no direct conflict, however. For starters, many
of the out-of-circuit decisions pointing in the other direction
predate TransUnion, a watershed decision on the standing
doctrine. See, e.g., Mitchell v. Blue Cross Blue Shield, 953 F.3d
529, 536 (8th Cir. 2020); Springer, 900 F.3d at 287; Katz v.
Pershing, LLC, 672 F.3d 64, 72 (1st Cir. 2012). Of the circuits to
consider the issue post-TransUnion, we understand one to
agree with our position, Perry v. Newsom, 18 F.4th 622, 632

-- 31 of 33 --

32 No. 20-3134
(9th Cir. 2021) (“An analogy to a traditionally recognized
cause of action does not relieve a complainant of its burden
to demonstrate an injury.”); one to leave it unresolved,
Glennborough Homeowners Ass’n v. U.S. Postal Serv., 21 F.4th
410, 415–16 (6th Cir. 2021) (“We need not resolve these
thorny questions today … .”); and one to come out the other
way, Denning v. Bond Pharmacy, Inc., 50 F.4th 445, 451 (5th
Cir. 2022) (“[A] breach of contract is a sufficient injury for
standing purposes.”). But the Fifth Circuit’s opinion in
Denning did not engage with the logic of Spokeo and
TransUnion and rested in part on its own precedent. We
therefore do not understand the Fifth Circuit’s decision to
conflict with our own, nor are we inclined to adopt its
approach. As we read Thole, TransUnion, and Spokeo, a
breach of contract alone—without any actual harm—is
purely an injury in law, not an injury in fact. And it therefore
falls short of the Article III requirements for a suit in federal
court.
C. Remaining Claims
We need not spend much time addressing the tortious-
interference and consumer-fraud claims. Both rest on the
same allegations of a privacy, pecuniary, or contractual
injury that we’ve already examined and deemed insufficient
to confer standing.
Put simply, Dinerstein seeks to invoke the power of the
federal courts to challenge the lawfulness of an event that
caused him no harm. But federal courts do not offer “judicial
determination[s] that the plaintiffs’ interpretation of the law
is correct”; we resolve cases and controversies. Uzuegbunam,
141 S. Ct. at 804 (Roberts, C.J., dissenting). Because
Dinerstein has not alleged a plausible, concrete, and actual

-- 32 of 33 --

No. 20-3134 33
or imminent injury to support his standing to sue, no such
case or controversy exists here. We accordingly modify the
judgment to reflect a jurisdictional dismissal for lack of
standing. As modified, the judgment is
A FFIRMED.

-- 33 of 33 --