## Facts

- The University of Chicago and its medical center partnered with Google to develop predictive health models using machine-learning methods.
- The University disclosed to Google de-identified electronic health records of adult patients treated from January 1, 2010 through June 30, 2016, including dates of service and other clinical and demographic data.
- Matt Dinerstein was hospitalized at the University in June 2015 and alleged the University created records containing sensitive medical information.
- Dinerstein alleged he used Google services that collected geolocation data, and that Google could combine that information with dates of service to re-identify patients.
- Dinerstein received an authorization form permitting use and sharing of medical information for IRB-approved, minimal-risk research and referencing compliance with applicable law, and a notice of privacy practices describing privacy protections.
- Dinerstein filed a putative class action asserting state-law claims against the University (express and implied contract, consumer fraud, unjust enrichment, and related confidentiality theories) and against Google (tortious interference, intrusion upon seclusion, and unjust enrichment).
- Defendants moved to dismiss the amended complaint; the University also moved to strike class allegations.

## Issues

1. Whether the alleged risk of re-identification, loss of control over data, or “benefit of the bargain” theory constituted a concrete injury sufficient for Article III standing.
2. Whether the complaint plausibly alleged compensable damages for breach of express contract based on the authorization and privacy notice.
3. Whether an implied confidentiality contract claim could proceed alongside an express contract covering the same subject matter.
4. Whether the University’s alleged privacy representations supported an Illinois Consumer Fraud claim absent actual damages proximately caused by deception.
5. Whether Google plausibly intended to induce the University’s breach to support tortious interference, and whether any resulting damages were adequately pleaded.
6. Whether Google’s receipt and use of data voluntarily provided by the University constituted intrusion upon seclusion under Illinois law.
7. Whether unjust enrichment could stand without an underlying actionable wrong, or where an express contract governed the parties’ relationship.

## Decision

- The court granted Google’s and the University’s motions to dismiss in full.
- The court concluded the alleged harms were too speculative, emphasizing the absence of allegations that any patient was actually re-identified or that Google misused the data.
- The express contract claim was dismissed primarily for failure to plead actual, compensable damages under Illinois law.
- The implied contract claim was dismissed as duplicative of the express contract.
- The Illinois Consumer Fraud claim was dismissed for failure to plead actual damages proximately caused by any deceptive act.
- The tortious interference claim was dismissed for failure to plausibly allege Google’s intent to induce breach and for lack of non-speculative damages.
- The intrusion upon seclusion claim was dismissed because the alleged conduct involved data voluntarily disclosed under a research arrangement, not an intrusive acquisition.
- The court declined to recognize a standalone tort for breach of medical confidentiality on these allegations.
- Unjust enrichment claims were dismissed as derivative of the failed substantive claims and as generally unavailable where an express contract controls.
- The University’s motion to strike class allegations was terminated as moot.

## Legal Principles

- Article III standing requires a concrete, non-speculative injury; a claimed risk of future harm is insufficient without plausible allegations of actual misuse or imminent injury.
- Under Illinois contract law, breach of contract requires actual damages; abstract privacy harms and generalized loss of control over information do not, without more, establish compensable loss.
- An implied contract claim generally cannot proceed when an express contract governs the same subject matter.
- Illinois Consumer Fraud claims require actual damages proximately caused by the alleged deception; conclusory “benefit of the bargain” allegations fail absent facts showing overpayment or other out-of-pocket loss.
- Tortious interference requires plausible allegations of intentional inducement of breach and resulting damages.
- Intrusion upon seclusion requires an intentional intrusion that is highly offensive; receipt of information voluntarily disclosed by a third party under an agreement does not fit the traditional tort.
- Unjust enrichment is typically derivative and fails when the underlying claims fail; it also is generally unavailable where an express contract governs the parties’ rights.

## Conclusion

The court dismissed a putative class action challenging a university’s sharing of de-identified patient records with a research partner, holding that speculative re-identification risk and asserted loss of privacy did not supply concrete injury or contract/consumer-fraud damages, and that the pleaded facts did not establish recognized Illinois privacy torts or independent unjust enrichment.


Dinerstein v. Google, LLC, 484 F. Supp. 3d 561 (N.D. Ill. 2020)