### In the 

# United States Court of Appeals
f

or the Seventh Circuit

____________________ No. 20-3134
M ATT D INERSTEIN , individually and on behalf of all others similarly situated, Plaintiff -Appellant ,

v.

G OOGLE , LLC ; U NIVERSITY OF C HICAGO ; and U NIVERSIT Y OF C HICAGO M EDICAL C ENTER ;
Defendant s-Appellees

.

____________________ Appeal from the United States District Court for the Northern District of Illinois , Eastern Division. No. 19 C 4311 — Rebecca R. Pallmeyer , Chief Judge

.

____________________
A RGUED S EPTEMBER 17, 2021

— D ECIDED J ULY 11, 2023

____________________

Before S YKES , C hief Judge , and F LAUM and K IRSCH , Circuit Judges

. S YKES , Chief Judge

. This class

- action lawsuit arises from a research collaboration between Google and the University of Chicago together with its affiliated Medical Center . (We will refer to the latter two as “the University” unless the context2 No. 20-3134

requires otherwise. ) Harnessing the power of artificial intelligence , t he research partners aspired to develop software capable of anticipat ing patients’ future healthcare needs

. If successful , the software promised to reduce medical complications , eliminate unnecessary hospital stays , and, ultimately, improve patients’ healthcare outcomes

. As an initial step in the research effort , t he University delivered several years of anonymized patient medical records to Google , thus suppl ying it with the information needed to

“ train ” the software’s algorithms

. A Data Use Agreement governed the transfer . R es trict ing Google’s use of the records to a list of specific research

- related activities , the

a greement expressly prohibited the company from attempting to identify any patient whose records were disclosed

. The anonymized electronic records subject to the agreement included those of Matt Dinerstein, twice an inpatient at the hospital during the period covered by the records disclosure. Dinerstein sued Google and the University on behalf of himself and a class of other patient s whose anonymize d records were disclose d. He alleged s everal theories of liability

. He first claimed that the University had breached either an express or an implied contract traceable to a privacy notice he received and an authorization he signed upon each admission to the Medical Center. Alternatively, he asserted a claim for unjust enrichment. Citing the same notice and authorization, he also alleged that the University had reneged on its promise of patient confidentiality and therefore violated the Illino is Consumer Fraud and Deceptive Business Practices Act, 815 I LL

. C OMP

. S TAT . 505/1 et seq . A gainst Google , he a sserted claims for unjust enrichment and tortious interfer ence with his contract with the University.No. 20-3134 3

Finally, he brought a privacy claim against all defendants based on allegations of intrusion upon seclusion

. The district judge dismissed the consumer

- fraud claim for lack of standing and the rest of the suit for failure to state a claim. We agree with her decision to dismis s the case , but

our analysis begins and ends with standing

. Dinerstein has
not adequately alleged standing to pursue any of his claims

. To sue in federal court, a plaintiff must plausibly allege (and later prove) that he has suf fered a n injury in fact that is
concrete and particularized, actual or immi n ent , and traceable to the defendant’s conduct . T he injuries D inerstein allege s lack plausibility, concreteness , or imminence (or some combination of the three ). Because the complaint fail s to plausibly allege a n injury in fact , we affirm but modify the judgment to reflect a jurisdictional dismissal for lack of standing. I. Background
O ur factual account is drawn from Dinerstein’s amended complaint . W e begin with a description of his inpatient s tays at the University Medical Center

— and more particularly, the paperwork he received at the start of each admission

. Dinerstein alleges that he was first admitted to the Medical Center on June 4, 2015 , and was discharged three days later

. He was then readmitted on June 25, this time for a two

- night stay. Upon each admission Dinerstein received a Notice of Privacy Practices detailing the University’s confidentiality obligations and the circumstances in which it might use or disclose patient medical information. Relevant here, the

n otice stated that the University would obtain “written permission” for the sale of such information. P atient p ermission was not required, however, for the University to use or4 No. 20-3134

share the information in limited research

- rela ted circumstances. In addition to the n otice, Dinerstein received andsigned an Admission and Outpatient Agreement and Authorization

. By doing so he affirmed that he understood that his medical information might be shared for approved research purposes and that if so, he would “not be entitled to any compensation.” He further acknowledged that “all efforts” would “be made to protect [his] privacy ” and that “any use of [his] medical information” would comply with both the n otice a nd “federal and state laws.” During Dinerstein’s two hospital stays, the University compiled records of his vital readings , medical procedures, prescriptions, test results, and diagnoses. The records also contained demographic information

. After each d ischarge from the hospital , the Medical Center maintained electronic copies o f his patient records. Approximately two years after Dinerstein’s hospital visits , Google announced that it had partnered with the University to research new healthcare technology. With the help of machine learning, the research partners aspired to develop predictive modeling software t hat would improve the ability of medical providers t o forecast their patients’ medical need s and , in turn , to tailor subsequent medical care

. As described in promotional statements, the project had the potential to prevent medical complications, reduce hospital visits, and improve overall health and well

- being. 1

1 Matt Wood, UChicago Medicine Collaborates with Google to Use Machine Learning for Better Health Care , UC HICAGO M EDICINE (May 17, 2017) , https://www.uchicagomedicine .org/forefront/research

- and

- discoveries

articles/uchicago

- medicine

- collaborates

- with

- google

- to

- use

- machine

learning

- for

- better

- health

- care.No. 20-3134 5

To reliably predict medical outcomes , the models needed extensive information from which to learn. The University thus agreed to transfer to Google a large set of anonymized patient medical records. A Data Use Agreement executed by the partne rs in December 2016 governed the transfer. While most of the a greement’s provisions are irrelevant for our purposes , a few deserve mention

. First, the a greement contemplated that befor e disclo sure the University would strip the patient records of all direct identifying informatio n except the dates of medical events and services

. Second, the

a greement delineated the records’ authorized uses. In particular , Google was permitted to use the records onl y to identif y key medical information , to develop predictive models , and to assess the models’ efficacy

. It could neither disclose information from within the record s nor use the records in contravention of federal law. M ost importantly, the a greement strictly prohibited Google from using the records “ to identify any individual.” Third, if the parties’ research efforts proved successful, the agreement granted the University a perpetual license to use the predictive models for its own “ internal non

- commercial research purposes. ”
The batch of medical records covered by the Data Use Agreement spanned several years . S pecifically , the a greement directed the University to transfer to Google a nonymized records generated from all inpatient, outpatient, and emergency adult

- patient encounters between January 1, 2010, and June 30, 2016. Both of Dinerstein’s overnight stays occurred in June 2015 , so his medical records were included in the set disclosed to Go ogle. Dinerstein alleges that the University never obtained his consent

— written or other-6 No. 20-3134

wise

— for the third

- party record disclosure. Nor did Google seek permission to use his records.

Dinerstein filed suit against the University and Google seeking damages a nd injunctive relief on behalf of himself and a class of patients whose anonymized records were disclosed

. He raised seven claims for relief

. Against the University he alleged claims for breach of an express or an implied contract premised on the n otice he received and the

a uthorization he signed upon each admission to the Medical Center. More to the point, Dinerstein alleged that in exchange for hi s payment and personal medical information , the University had agreed to protect and secure his information . By sharing it with Google, the University had failed to uphold its end of the bargain. As an alternative to his contract claims, Dinerstein sought damages for unjust enrich ment

. He also alleged a claim for violation of the Illinois Consumer Fraud and Deceptive Business Practices Act

. This statutory claim rest ed on t he alleged broken promises , which Dinerstein asserted the University never intended to keep in the first place

. Turning to Google , Dinerstein alleged that the com pany had tortious ly interfere d with his contract wit h the University . H e also a sserted a cl aim for unjust enrichment based on the company’s receipt of valuable patient medical records

. Finally, Dinerstein brought a tort claim against Google and the Univers ity for in va sion of privacy . M ore specifically, he alleged that they had intruded upon his seclusion by sending and receiving his sensitive medical information.
Relevant to th is last theory of liability , Dinerstein claimed that while he was an inpatient at the Medical Center, he had used a smartphone with geolocation capabilities . Because heNo. 20-3134 7

had also downloaded v arious Google apps , he alleged that the phone granted the company access to his precise location during every moment of his hospital st ays. He further alleged that i f Googl e compared his l ocat ion data with the insufficiently anonymized p atient records, it could easily ascertain his identit y and uncover “intimate private details” in his medical histories

. And he alleged that Google could do the same thing with other class members’ geo location data.
The defendants moved to dismiss under Rule s 12(b)(1) and (6 ) of the Federal Rules of Civil Procedure . They argu ed that Dinerstein had not allege d a concrete injury to support Article III standing and, alternatively, that he had not state d a cognizable claim. The judge granted the motion, a greeing primarily with the latter argument and dismiss ing the complaint in its entirety.
On the standin g issue, the judge construed Dinerstein ’s alleg ations about a lost benefit of the bargain as sufficient to support standing to sue on the contract (and contract

a lternative ) theories against both the University and Google

. Dinerstein v. Google, LLC , 484 F. Supp. 3d 561, 574 (N.D. Ill. 2020). S he also reasoned that the allegations about a n invasion of privacy

— in the form of a wrongful disclosure of his private medical information

— support ed Dinerstein’s standing to sue for intrusion upon seclusion

. Id. at 575. But t he judge dismissed the consumer

- fraud claim for lack of standing because “[a] claim under [the Illinois Consumer Fraud and Deceptive Business Practices Act] requires a showing of actual damages,” which Dinerstein had not alleged. Id. at 579 (citing 815 I LL

. C OMP

. S TAT . 505/10a(a)). Moving on , the judge dismissed th e claims for breach of
contract

— express or implied —f or failure to state a cogniza-8 No. 20-3134

ble claim b ecause Dinerstein had not adequately pleaded economic damage s, a required element under Illinois law

. Id. at 590 –93; F ED

. R. C IV

. P. 12 (b)(6). Next , the judge noted but chose not to decide the question whether Dinerstein’s claim for tortious interference with contract necessarily fell with the other contract claims

. Instead , she held that the claim failed for a separate reason: Dinerstein had not sufficiently pleaded that Google had intentionally caused the University’s breach of contract

. Id. at 593. (Intent is n ecessary to state a claim of tortious interference with contract in Illinois. HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc. , 545 N.E.2d 672, 676 (Ill. 1989).) Turning to the p rivacy claim, the judge observed that Dinerstein had re characterized his original intrusion

- upon

seclusion cla im as a novel tort claim for breach of medical confidentiality , a theory n ot yet recognized in Illinois. The judge thought it unlikely that the Illinois Supreme Court would recognize such a claim, so she declined to permit Dinerstein to p ursue it in federal court. That left only the unjust

- enrichment claim s. B ecause unjust enrichment is not an independent cause of action in Illinois, t he judge dismissed th o se claim s as well

. Dinerstein appealed.
II. Discussion
The dismissal order rests partly on a fai lure to allege Article III standing but mostly on the judge’s conclusion that Dinerstein failed to state a claim upon which relief can be granted

. Our review of either basis for dismissal is de novo

. Nowlin v. Pritzker , 34 F.4th 629, 632 (7th Cir. 2022). T he parties primarily focus on whether the amended complain t satisfies the statutory and common

- law pleading requirements particular to each claim. But the threshold question isNo. 20-3134 9

standing , which “is jurisdictional and cannot be waived.” Nettles v. Midland Funding LLC , 983 F.3d 896, 899 (7th Cir. 2020).
S tanding doctrine traces its origins to Article III of the Constitution, which grants federal courts the power to resolve “Cases” and “Controversies.” U.S. C ONST

. art. III, § 2. T he doctrine’s elements are well established and familiar

. To sue in federal court, a plaintiff must have suffered (1) a concrete, particularized, and actual or imminent injury (an “injury in fact” ) (2) that is fairly traceable to the defendant and (3) that is likely to be redressed by a favorable judicial decision. Lujan v. Defs. of Wildlife , 504 U.S. 555, 560

– 61 (1992).

“ [A]t the pleading stage, the plaintiff must clearly

... allege facts demonstrating each element.” Spokeo, Inc. v. Robins , 578 U.S. 330, 338 (2016) (quotation marks omitted). Moreover, “standing is not dispensed in gross; rather, plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek.” TransUnion LLC v. Ramirez , 141 S. Ct. 2190, 2208 (2021). Like many of our recent cases concerning Article III standing , this one hinges on the injury

- in

- fact element , and i n particular, the concreteness and imminence requirements. While the concreteness requirement examines the substance of a plaintiff’s asserted injury , the imminence requirement measures its likelihood

. In other words , to provide a basis to sue in federal court, an inj ury must exist “in both a qualitative and [a] temporal sense.” Whitmore v. Arkansas , 495 U.S. 149, 155 (1990). Starting with the qualitative aspe ct, “[a] concrete injury must be de facto ; that is, it must actually exist.” Spokeo , 578 U.S. at 340 (quotation marks omitted). Endorsing the10 No. 20-3134

term’s “usual meaning,” the Supreme Court has described a concrete injury as one that is “real [] and not abstract.” Id. (quotation marks omitted). Both tangible and intangible harms may fit th e bill , even if tangible harms like “ physical or monetary injur[ies]” are perhaps more intuitively concrete. TransUnion , 141 S. Ct. at 2204. As the Court has explained , o ur task

— especially when the plaintiff ass ert s an intangible harm

— is to assess whether the alleged injury has

“ a close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts .” Id. (quotation marks omitted). The inquiry asks whether the plaintiff has “ identified a close historical or common

- law analogue” for his asserted injury. Id. Put another way , when reviewing a plaintiff’s a lleged injury for concreteness, “[h]istory and tradition remain our ever

- present g uides.” Pierre v. Midland Credit Mgmt. , Inc. , 29 F.4th 934, 938 (7th Cir. 2022).
Imminence is more of an “elastic concept.” Lujan , 504 U.S. at 564 n.2. While it lacks a precise framework , the basic function of the imminence requirement “ is to ensure that the alleged injury is not too speculative for Article III purposes.” Id. Accordingly, a plaintiff who has not suffered a past harm cannot simply rest on allegations that he may suffer some “possible future injury,” Whitmore , 495 U.S. at 1 58, “at some indefinite future time ,” Lujan , 504 U.S. at 564 n.2

. His threatened injury instead must be “ certainly impending” to satisfy Article III. Id. And importantly, while an imminent risk of future harm may suffice to support standing to sue for prospective relie f (i.e., an injunction), a claim for damages requires a concrete harm that has in fact occurred. TransUnion , 141 S. Ct. at 2210–11.No. 20-3134 11

With these fundamental standing principles in mind, we turn to t he claims presented in this case. At the outset, however, we note that Dinerstein omitted from his opening brief any discussion about the claims for unjust enrichment

or breach of an implied contract. By doing so, he abandoned the se claims on appeal , and w e need not consider them. See White v. United States , 8 F.4th 547, 552 (7th Cir. 2021); see also F ED

. R. A PP

. P. 28 (a)(8) (A) (requiring th at the appellant’s brief include his “contentions and the reasons for them”). What remains is the privacy claim, the claim for breach of an express c ontract, the consumer

- fraud claim , and the claim for tortious interference with contract . We address each in turn. A. Privacy Claim

W e begin w ith the alleged breach of privacy because the

a sserted injury underlying this claim is common to all claims that remain live on appeal

. In other words, our resolution of the standing issue on this claim necessarily resolves portions of others, streamlining our discussion of the claims that follow

. Before diving into the standing analysis, we must discern what, exactly, Dinerstein’s privacy claim is. H is complaint characterizes the defendants’ conduct as a common

- law intrusion upon seclusion, which is potentially actionable when the alleged tortfeasor “intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another.” R ESTATEMENT (S ECOND ) OF T ORTS § 652(B) ( A M

. L AW I NST

. 1977) [hereinafter R ESTATEMENT ]. The Illinois Supreme Court has adopted this definition of the tort , de scrib ing the purpose of the seclusion right as “protecting a person from another’s prying into their physical boundaries or affairs.”12 No. 20-3134

W. Bend Mut

. Ins. Co. v. Krishna Schaumburg Tan, Inc. , 183 N.E.3d 47, 58 ( Ill. 2021) ; see also Lovgren v. Citizens First Nat ’l Bank , 534 N.E.2d 987 , 988–89 (Ill. 1989). Apparently accepting that neither defendant’s conduct fit s the elements of th is tort, Dinerstein abandon ed his intrusion

- upon

- seclusion theory below , as the district judge noted

. Dinerstein , 484 F. Supp. 3d at 594. In his re spon se to the defendants’ motion to dismiss , Dinerstein reframe d his privacy claim as a breach of medical confidentiality , a novel

cause o f action that posits a common

- law duty of medical provider s to maintain patient confidentiality. S everal states have recogn ized some variety of this tort. See, e.g. , Lawson v. Halpern

- Reiss , 212 A.3d 1213, 121 9 (Vt. 2019); Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C. , 175 A.3d 1 , 17 (Conn. 2018); McCormick v. England , 494 S.E.2d 431, 437 (S. C. Ct. App. 1997). But Illinois is not one of the m. Dinerstein therefore invited the district judge, sitting in diversity, to hold that the Illinois Su preme Court would recognize the tort under Illinois law

. See Zahn v. N. Am. Power & Gas, LLC , 815 F.3d 1082, 1087 (7th Cir. 2016) ( [W]e must use our own best judgment to estimate how the [I llinois] Supreme Court would rule as to its law.” (quotation marks omitted)). As we’ve noted, the judge declined that invitation

. Dinerstein , 484 F. Supp. 3d at 595. More importantly for our purposes, however, Dinerstein has chosen to stick with the new version of his privacy claim on appeal . H e premise s his privacy

- related challenges exclusively on the novel medical

- confidentiality theory. F ollowing his lead, then, we focus our discussion o f standing on the reframed privacy theory

.No. 20-3134 13

Dinerstein presents his privacy injury in two forms , one backward

- looking and the other forward

- looking. But considered in either direction

— past or future

— his asserted injury does not establish standing to sue.

1. Past Harm
We start with the backward

- looking form of injury

. Crucially, Dinerstein does not allege that Google has already used the disclosed patient records to discern his identity

. Instead he focus es on the conduct of the University , arguing that the record transfer was itself a n actionable invasion of his medical privacy . This is so, Dinerstein asserts, regardless of whether Google ever actually identifies him

. By referencing a common

- law privacy invasion, Dinerstein attempts to compare his asserted injury to a harm “traditionally recognized as providing a basis for lawsuits in American courts .” TransUnion , 141 S. Ct. at 2204 . In other words, he engages with the proper inquiry under the Supreme Court’s recent standing caselaw. B ut as we’ve explained, an “invasion of privacy” is not a standalone tort; the term “encompasse[ s] four theories of wrongdoing: intrusion upon seclusion, appropriation of a person’s name or likeness , publicity given to private life, and publicity placing a person in a false light.” Pucillo v. Nat’l Cred it Sys., Inc. , 66 F.4th 634, 639– 40 (7th Cir. 2023) (quoting Persinger v. S w. Credit Sys., L.P. , 20 F.4th 1184, 1192 (7th Cir. 2021) ); see also R ESTATEMENT §§ 65 2A–652E. And because TransUnion requires us to nail down a particular common

- law analogue,

we must assess whether any of the recognized privacy torts is sufficiently analogous to Dinerstein’s asserted injury

. If
not , no concrete harm. “N o concrete harm, no standing.” TransUnion , 141 S. Ct. at 2214.14 No. 20-3134

Of the four traditional privacy tort theories , the closest comparator to Dinerstein’s new theory is probably the tort of publicity given to private life , which occurs when someone “gives publicity ” to a “highly offensive” matter “ concerning the private life of another ” that “ is not of legitimate concern
to the public .” R ESTATEMENT § 652D. Yet Dinerstein has identified no case in which a court has permitted a plaintiff
to bring a public

- disclosure tort premised on the dissemination of anonymized information

. 2 Indeed, while the relevant caselaw is sparse, we ’re skeptical that this alleged factual scenario would give rise to any injury at all

— let alone one concrete enough to support Article III standing

. See , e.g. , Shulman v. Grp. W Prods., Inc. , 955 P.2d 469, 489 n.12 (Cal. 1998) (“ [ C ] omplete lack of identification or identifiability would seemingly defeat a private facts claim, as there could be no injury ... .”); Harris ex rel. Harris v. Easton Pub l’g Co. , 483 A.2d 1377, 1385 (P a . 1984) (“Absent an ability to identify the complainant, there can be no communicatio n and hence, no publicity.”); cf. Frobose v. Am. Sav. & Loan Ass’n , 152 F.3d 602, 618 (7th Cir. 1998) (rejecting a false

- light claim because the communication neither mentioned the plaintiff by name nor made her “readily identifiable to the public”). Resisting this conclusion, Dinerstein contend s that the University’s records were ins ufficiently anonymized. He cites a presentation from the 2017 Google Cloud Next conference by Dr. Samuel Volchenboum, the University’s Associate Chief Research Informatics Officer. Dinerstein argues that Dr. Volchenboum ’s presentation highlighted

2 Nor has Dinerstein identified a case in which a court has permitted a plaintiff to bring the novel claim of breach of medical confidentiality in circumstances like these.No. 20-3134 15

various deficiencies in the “typical de

- identification process .” 3 He contends that the process risks leaving identifying clues like the patient’s age, place of residence, and family relations scattered throughout the purportedly “ de

identified ” medical records

. According to Dinerstein, s uch clues are routinely found in the treating physician’ s “free

text” clinical notes

. If these clues are pieced together, reidentification is supposedly simple

. But Dinerstein’s complaint omits any allegation s linking the so

- called “typical de

- identification process” described in Dr. Volchenboum’s presentation to the University’s de

identification process here

. Put differently, just because some de

- identification process es might be deficient, we cannot assume that the University’s process was necessarily so. To the contrary, the complaint acknowledges that the challenged record transfer occurred pursuant to the Data Use Agreemen t , which state s that “the majority of [patient] identifiers will be removed,” leaving only “actual dates of [medical] service and events.” Dinerstein’s allegations of insufficient ano nymization therefore do not cross the plausib ility threshold

. See Silha v. ACT, Inc. , 807 F.3d 169, 174 (7th Cir. 2015) ( “[T]he Twombly

- Iqbal facial plausibility requirement for pleading a claim is incorporated into the standard for pleading subject matter jurisdiction.”).

M ore over , Dinerstein appears to concede that the University adequately discharged its de

- identification obligation . D escrib ing a jointly authored articl e from the University and Google , the complaint states that al though

3 Google Cloud Tech, Sensitive Data Management for Collaborative Research Clouds (Go ogle Cloud Next '17)
, Y OU T UBE (Mar. 9, 2017), https://www.youtube.com/watch?v=7Si956MXhWQ.16 No. 20-3134

“the [ date stamps ] from the University patients’ records were maintained,” the records otherwise had been “de

identified .” And aside from the date stamps, Dinerstein does
not pinpoint any information with in the records that he thinks should have been redacted and was not

. Nor does he allege that the date stamps alone were impermissibly identifying. At most he alleges that some personally identifying information “may have evaded redaction ”—a hypothetical that does not support his repeated but conclusory assertions that the University’s records were insufficiently anonymized. “S uch

... bare assertion [s] of harm

— unsupported by any concrete details ”— do not suffice to allege a plausible , concrete injury. Nowlin , 34 F.4th at 633.

2. Risk of Future Harm
That bri ngs us to Dinerstein’s allegations of a forward

looking privacy injury . U nlike the backward

- lookin g injury, this injury turns on Google’s conduct

— or more precisely, its anticipated conduct. At bottom , Dinerstein worries that the date stamps contained in the transferred medical records , along with the geolocation and demographic data collectedfrom his smartphone apps, offer Google a “perfect formulation of data points” for later reidentification. In other words, the record transfer created a risk that he might someday be reidentified.
To the extent that Dinerstein rests his claim for damages on allegations of future risk , the argument is a nonstarter. In TransUnion the Supreme Court clarified that un less a “risk of future harm materializes,” a plaintiff may rely on an “imminent and substantial” risk of harm only when “pursu[ing] forward

- looking, injunctive relief to prevent the harm from occurring.” 141 S. Ct. at 2210–11 (emphasis added). Or as ourNo. 20-3134 17

court has summarized: “A plaintiff seeking money damages has standing to sue in federal court only for harms that have in fact materialized.” Pierre , 29 F.4th at 938. Because Dinerstein alleges no material harm arising from the alleged risk of future reidentific ation, that future risk cannot support standing to sue for damages. The alleged risk does not support standing to sue for injunctive relief either, though for a different reaso n: the risk Dinerstein alleges is not sufficiently imminent. To be sure, Google possesses a wealth of data about most , if not all , Americans. Yet Dinerstein ignores that the governing Data Use Agreement expressly prohibited Google from using the transferred medical records

— either by themselves or in tandem with data already in its possession

— “to identify any individual.” And e ven if th e contractual obligation doesn’t itself foreclose th e risk of reidentification , Dinerstein has not alleged that Google has taken any steps to identify him

. Nor , for that matter, does he allege that Google intends to do so. Without any allegations to that effect, “we cannot simply presume a material risk of concrete harm.” TransUnion , 141 S. Ct. at 2212 ( quoting Ramirez v. TransUnion LLC , 951 F.3d 1008, 1040 (9th Cir. 2020) (opini on of McKeown, J.) ). The risk of future injury is thus nowhere near “certainly impending”; it is too speculative to satisfy the imminence requirement for a suit for injunctive relief in federal court. Clapper v. Amnesty International USA , 568 U.S. 398 (201 3), supports this holding. In Clapper attorneys and human

- rights organizations raised constitutional challenge s to § 1881a of the Foreign Intelligence Surveillance Act, arguing that individuals with whom they regularly communicated were probable targets of foreign electronic surveillance under the18 No. 20-3134

Act. Id. at 406. Because of the possibility of surveillance , the plaintiffs claimed that their international communications were likely to be incidentally “acquired under § 1881a at some point in the fut ure.” Id. at 407.

T he Court rejected th is alleged future injury as a basis for standing , reasoning that it rested on multiple layers of “highly speculative fear .” Id. at 410. In particular , t he “chain of contingencies”

— specifically that (1) the g overnment would choose to target their foreign contacts pursuant to its § 1881a authority ; (2) the g overnment would succeed in both securing the requisite authorization and intercepting the targeted communications ; and (3) the plaintiffs would be parties t o those communications

— “d[id] not satisfy therequirement that threatened injury must be certainly impending.” Id. T he plaintiffs had offered little more than speculation and assumption s— and import antly , “no specific facts”

— that their communications would actually be acquired. Id. at 412. So too here. Dinerstein has expressed only

a “highly speculative fear” that Google might , “at some point in the future ,” identify him. Id. at 407, 410.
O ur decisions in Remijas v. Neiman Marcus Group, LLC , 794 F.3d 688 (7th Cir. 2015) , and Lewert v. P.F. Chang’s China Bistro, Inc. , 819 F.3d 963 (7th Cir. 2016), are not to the contrary . As an initial matter, both predate TransUnion

. While that i s not to say that they are no longer authoritative, it is to recognize that TransUnion marked a shift in the Court’s standing jurisprudence. But even on their own terms, Remijas and Lewert do not help Dinerstein’s standing argument here. In both cases we held that the plaintiffs had sufficiently alleged a substantial risk of futur e harm stemming fro m breach es of their credit

- card information

. Remijas ,No. 20-3134 19

794 F.3d at 693 –94; Lewert , 819 F.3d at 967. Motivating our decisions was the common

- sense observation that hackers steal private credit

- card information for a primary purpose: “to ma ke fraudulent charges or assume ... consumers’ identities.” Remijas , 794 F.3d at 693 ; Lew e rt , 819 F.3d at 967. The refore, the plaintiffs’ allegatio ns about a substantial risk of future harm had “cross[ed] the li n e from conceivable to plausible.” Lewert , 819 F.3d at 968 (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570 (2007)).
The same cannot be said here

. Absent from this case is a comparable indication

— rooted in common sense or otherwise

— that Google ’s prima ry purpose in obtaining the medical records was to reidentif y the University’s patients. Indeed, the fact that Google explicitly agreed not “ to identify any individual” is enough to rule out the contention that the threat of reidentification is certainly impending. Quite the opposite; th at contention is wholly speculative and implausible

. It cannot supply the basis for standing. 4
B. Contract Claim

Next we assess the alleged injuries underlying Dinerstein’s claim for breach of an express contract, a claim

4 Even if Dinerstein’s asserted privacy injury

— past or future

— were sufficient to support standing (it is not) , we see no reason to disturb the judge’s decision not to recognize a novel claim for breach of medical confidentiality. Illinois courts have not yet weighed in on the issue, and

“ it is not our role to break new ground in state law.” Roppo v. Travelers Com

. Ins. Co. , 869 F.3d 568, 596 (7th Cir. 2017) (quoting Lopardo v. Fleming Cos. , 97 F.3d 921, 930 (7th Cir. 1996)). This is especially true with “[i]nnovative state law claims,” which “should be brought in state court.” Insolia v. Philip Morris Inc. , 216 F.3d 596, 607 (7th Cir. 2000). But because Dinerstein lacks standing, w e have no need to address this issue.20 No. 20-3134

he brings only against the University. Recall that Dinerstein roots the University’s purported contractual duty in the Notice of Privacy Practices he received and the Admission and Outpatient Agreement and Authorization he signed each time he was admitted to the Medical Center. He argues that these documents contractually obligated the University
to safeguard his medical information

. In his view, t ransferring his medical records to Goo gle was a flagrant brea ch of that obligation

. To support standing to bring t his claim, Dinerstein a sserts three injuries

. The first stems from his interest in privacy

— i.e., the injury we’ve already addressed and deemed insufficient to support standing

. The second , presented in two forms, is pecuniary: Dinerstein contends that he overpaid the University for his medical treatment or, alternatively, that the University under paid him for the interest in his medical records. T he third is contractual : Dinerstein contends that the University’s breach of contract is itself an actionable concrete injury.

1. Pecuniary Harms
We turn first to Dinerstein’s alleged pecuniary injur ies , which the Supreme Court has described as “traditional tangible harm s ” that “readily qualif y as concrete injur ies under Article III.” TransUnion , 141 S. Ct. at 2204. Even if concrete, however, Dinerstein’s allegations of injury must be plausible “to survive dismissal for lack of standing.” Diedrich v. Ocwen Loan Servicing, LLC , 839 F.3d 583, 588 (7th Cir. 2016) (citing Ashcroft v. Iqbal , 556 U.S. 662, 678 (2009)) ; see also Silh a , 807 F.3d at 174. While Diner stein alleges both an overpayment and underpayment theory of financial harm, neither is plausible and neither supplies a basis for standing.No. 20-3134 21

Dinerstein ’s overpayment theory rests on allegations that the medical care he ( more precisely , his insur er) purc hased came bundled with a promise of medical confidentiality. Because the University failed to deliver on that promise, he contends that he was deprived of th e full benefit of his bargain. Not only that, he also would not have purchased the University’ s medical treatment had he known that it intended to share his private health information.
This is not the first time we’ve confronted an argument like this one

. In Remijas , 794 F.3d at 694

– 95, and Lewert , 819 F.3d at 968, the plaintiffs argued that they had overpaid Neiman Marcus and P.F. Chang’s, respectively, because the companies had failed to protect their credit

- card information. While we did not outright reject the plaintiffs’ theories , we expressed serious skepticism. We described the plaintiffs’ injuries in Remijas , for example, as “problematic .” 794 F.3d at 694. And in both cases we explained that courts have not entertained the overpayment theory of injury outside the product

- liability context , and we saw no need to extend it “beyond its current scope.” Lewert , 819 F.3d at 968; Remijas , 794 F.3d at 695. Dinerstein has not alleged a defect in his medical care , a nd we again are not inclined to recognize the overpayment theory outside the product

- liability context . (I n this case that would require extending it “from a particular product to the operation of [an] entire ” medical facility. Remijas , 794 F.3d at 695.) Perhaps a nticipating this doctrinal problem, Dinerstein tries to distinguish Remijas and Lewert , arguing that the overpayment theories in those cases were implausible because the companies had not charge d an extra fee for credit

- card transactions . In other words, the plaintiffs had22 No. 20-3134

not pa id for credit

- card data security. But this case is no differen t. It is wholly implausible

— and Dinerstein alleges nothing to the contrary

— that the University charged a discrete “patient

- confidentiality fee.” Indeed, the fact that it reserved the right to share patient medical information for approved research purposes suggests exactly the opposite. So too does the fact that Dinerstein signed a release stating that he would “not be entitled to any compensation , regardless of the value of such research or any products or inventions developed therefrom.”
Dinerstein’s most helpful case is from another circuit. In Carlsen v. GameStop , Inc. , 833 F.3d 903, 909 (8th Cir. 2016), the Eighth Circuit held that the plaintiff had alleged an “actual”financial injury “in an amount equal to the difference between the value of [what] he paid for and the value of [what] he received, i.e. , a [ digital magazine] subscription with compromised privacy protection.” A s our decisions in Remijas and Lewert make clear, we ’re not inclined to extend the overpayment theory of injury to novel contexts

. Regardless, Carlsen is also distinguishable for the reason we just mentioned: Dinerstein’s overpayment injury is particularly implausible given his express agreement that his medical information “may be used and shared for research.” And h is argument that he would not have paid for the University’s medical services had he known otherwise is similarly implausible

. We are even more skeptical o f Dinerstein’s second pecuniary theory

— that the unauthorized use of his medical information conferred a financial benefit on the University to which he is entitled. This financial benefit apparently came in the form of the perpetual software license reserved for theNo. 20-3134 23

University in the Data Use Agreement. To remedy the University’s unjust benefit , Dinerstei n suggests that the court could order d isgorgement or “at least a reasonable royalty .”

P utting aside the fact that Dinerstein agreed that he was not entitled to compensation for the use of his medical information, his asserted injury cannot supply a basis for standing. As an initial matter, Illinois law does not grant a patient a property interest in his medical records; the y instead belong to the medical provider. Young v. Murphy , 90 F.3d 1225, 1236 (7th Cir. 1996) (“ While Illinois law permits a p atient to inspect and copy his records ... , there is no basis for concluding that this grants a property interest in those records to the patient.”); Holtkamp Trucking Co. v. Fletcher , 932 N.E.2d 34, 43–44 (Ill. App. Ct. 2010). Additionally, this standing theory is squarely foreclosed by our caselaw. In Silha we held “that a plaintiff’s claim of injury in fact cannot be based solely on a defendant’s gain ; it must be based on a plaintiff’s loss .” 807 F.3d at 174 –75. There , students who had taken standardized college admissions tests alleged that the testing agencies had shared their personal information with educational institutions

. The students had consented to information sharing, yet the agen cies had not disclosed that they had profited from w hat was really a sale of the students’ information

. Id. at 171. While the complaint highlighted the agencies’ profits, missing was any allegation that the students had “lost anything of value as a result of the alle ged misconduct.” Id. at 175. Because thei r claimed injury was “based solely on a gain” to the agencies, we held that the students had not established an injury in fact. Id.24 No. 20-3134

So too here. Dinerstein has not alleged that the University’s use of his medical information somehow deprived him of its economic value

. And a lthough Dinerstein attempts to dis tinguish Silha by arguing that unlike him, the students had consented to disclosure, nothing about our resolution of the case turned on consent. Silha ’s controlling principle

— that a plaintiff cannot base an injury in fact solely o n the defendant’s gain

— likewise controls here. In sum, neither of Dinerstein’s alleged pecuniary injuries establish es standing to sue under Article III.

2. Breach of Contract What’s left, then, is Dinerstein’s argument that a breach of contract is itself a legally cognizable injury in fact. He contends that common

- law courts traditionally entertained claims for breach of contract regardless of whether the plaintiff alleged a ny harm beyond the breach itself. F rom this he infers that an alleg ation of a breach of contract is enough , without more, to support Article III standing

. In his view, our caselaw supports his interpr etation, and the Supreme Court’s recent standing cases, namely Spokeo and TransUnion , do not disturb it.
Even if Dinerstein’s historical account is correct , we read the Court’s recent standing case s differently. In TransUnion the Court confirmed that “an injury in law is not an injury in fact.” 141 S. Ct. at 2205. That statement itself might be enough to resolve Dinerstein’s “breach- alone” standing theory

. Yet to explain why our view diverges from Dinerstein’s and that of one of our sist er circuits , some addition al unpacking is warranted.No. 20-3134 25

As we’ve already discussed, establishing an injury in fact requires a plaintiff to show that he has suffered a concrete injury

— one that is both “real” and “ de facto ” and that “actually exist[s] .” Spoke o , 578 U.S. at 340. Refining the concreteness requirement, the Court in TransUnion emphasized the distinction between (1) the cause of action giving a plaintiff the right to sue over a defendant’s legal infraction and (2) the injury , if any , that he s uffer ed as a result. 141 S. Ct. at 2205. To sue in federal court, a plaintiff must have both ; a suitable cause of action cannot save a plaintiff’s case if he has suffered no harm

. In other words , o nly a plaintiff who has been “ concretely harmed ” by the defendant’s legal infraction “may sue that private defendant over [it] in federal court.” Id. Applying th e se concepts here, Dinerstein cannot rest on the University’s alleged breach of contract as a discrete de facto injury supporting his standing to s ue in federal court

. It is at most an injury in law , which we know from TransUnion

“ is not an injury in fact.” Id. (emphasis added). A s one scholar put it: The logic of Spokeo

— that standing cannot rest on violations of legal rights that do not result in factual harms

— extends to suits alleging breach of contract. After all, contracts simply establish legal rights. By Spokeo ’s reasoning, a plaintiff should not have standing to su e for breach of contract if the breach does not result in some additional factual harm. F. Andrew Hessick, Standing and Contracts , 89 G EO

. W ASH

. L. R EV

. 298, 313 (2021). Slightly rephrased , Dinerstein cannot simply allege a bare breach of contract, “ divorc ed from any26 No. 20-3134

concrete harm, and satisfy the injury

- in

- fact requirement of Article III.” Spokeo , 578 U.S. at 341. Without an allegation that the purported breach resulted in some concrete harm, we lack the “ freewheeling power ” to hold the University accountable for its alleged “ legal infraction[] .” Casillas v. Madison Ave. Assocs., Inc. , 926 F.3d 329, 332 (7th Cir. 2019).
Yet Dinerste in retorts that Spokeo and TransUnion are irrelevant to the standing question here because neither address ed common

- law claims like breach of contract

. He reads the cases to answer only whether ( and if so, when ) Congress may “ elevate to the status of legally cognizable” an injury that was “previously inadequate in law.” TransUnion , 141 S. Ct. at 2204

– 05 (quoting Spokeo , 578 U.S. at 341). To be
sure, Spokeo and TransUnion did address and decide those questions. But we read the s tanding principles expounded in those cases to extend beyond the statutory context

. The Court’s opinion in TransUnion , for example, set out to answer the broader question: “What makes a harm concrete for purposes of Article III?” Id. at 2204. In answering that question, the Court issued important and broad ly applicable
statements , including those just mentioned, about the boundaries of the federal judicial power

. Fairly interpreted , those statements apply to all asserted injuries , not just statutory violations

. To give a few more examples of TransUnion ’s capacious language , the Court observed that where a “ plaintiff has not suffered any physical, monetary, or cognizable intangible harm traditionally recognized as providing a basis for a law suit in American courts,” his “lawsuit may not proceed.” Id. at 2206. And it defended “the concrete

- harm requirement” as “essential to the Constitution’s separation ofNo. 20-3134 27

powers.” Id. at 2207. Article II I does not empower federal courts “to publicly opine on every legal question” or to “exercise general legal oversight ... of private entities.” Id. at 2203. Yet by asking us to weigh in on the University’s alleged breach of contract in the absence of any act ual harm , Dinerstein invites us to function “not as an Article III court, but as a moot court,” and do exactly that. Uzuegbunam v. Preczewski , 141 S. Ct. 792, 804 (2021) (Roberts, C.J., dissenting). We decline the invitation

. Taking up such matters “is, by very definition, for a court to act ultra vires.” Steel Co. v. Citizens for a Better Env’t , 523 U.S. 83, 102 (1998). These gener al standing principles guided the Court as it then considered when Congress may give a real

- world injury “actionable legal status .” TransUnion , 141 S. Ct. at 2205. And c ontrary to Dinerstein’s view , t he Court’s framing of th is more specific question also supports our reading of its recent caselaw. Rather than ask whether federal courts may depart from established standing doct rine when Congress has attempted to define an injury , in Spokeo and Trans Union the Court explored when a congressionally defined injury might satisfy th e existing doctrine . The cases speak , for example, about Congress ’s lack of authority to “erase Article III’s standing requirements,” Spokeo , 578 U.S. at 339 (quotation marks omitted), and about our obligation to

“ independently decide whether a plaintiff has suffered a concrete harm under Article III” notwithstanding Congress’s creation of new statutory duties , TransUnion , 141 S. Ct. at 2205. Simply put , Spokeo and TransUnion established “fundamental standing principles,” id. at 2207, and those principles control this case.28 No. 20-3134

If Spokeo and TransUnion leave any doubt about whether

a breach of contract is itself a concrete injury , Thole v. U.S. Bank N.A. , 140 S. Ct. 1615 (2020), resolves it. Thole involved claims for breach of fiduciary dut y under ERISA . Two participants in a defined

- benefit retirement plan sued the bank contending tha t it had mismanaged the plan . But crucially, they had sustained no monetary injury from the mismanagement

. Id. at 1618. The Supreme Court thus affirmed the Eighth Circuit’s dismissal for lack of standing and in so doing rejected the participants’ attempted trust

- law analogy. “[A] defined

- benefit plan,” the Court reasoned , “is more in the nature of a contract . The plan participants’ benefits are fixed and will not change, regardless of how well or poorly the plan is managed.” Id. at 1620 (emphasis added). Be cause the Court held that the plan participants nonetheless lacked standing to pursue their claims, we understand Thole to imply that a n alleged breach of contract , without any corresponding actual harm, does not give rise to an Article III case or controversy. 5 Nor are we persuaded by Dinerstein’s argument that the Court’s instruction s in Spokeo and TransUnion

— that we must compare th e plaintiff’ s asserted injury to harms traditionally recognized at common law

— resolves the standing question here. A s we understand the argument, he contends that

5 In fact, the dissent raised this precise point. Thole v. U.S. Bank N.A. , 140 S. Ct. 1615, 1630 (2020) ( Sotomayor, J., dissenting) ( reasoning that the plan p articipants had standing because a “ breach of contract always creates a right of action , even when no financial harm was caused” (quotation marks omitted)). That the majority was not persuaded by this view further supports our conclusion that a breach of contract does not by itself confer standing to sue.No. 20-3134 29

because common

- law courts allowed a plaintiff to vindicate his contract ual rights without a further showing of injury, he need not allege anything aside from t he University’s bare breach of contract.

True , co mmon

- law courts historically heard contract c ases and awarded nominal damages even when the breach either “ caused no loss” or “the amount of the loss [wa]s not proved.” R ESTATEMENT (S ECOND ) OF C ONTRACTS § 346(2) (A M

. L AW I NST . 1981) ; see also Springer v. Cleveland Clinic Emp. Health Plan Total Care , 900 F.3d 284, 292 –93 (6th Cir. 2018) (Thapar, J., concurring) ( “[Common

- law courts] entertained breach

- of

- contract claims even when no real loss [could] be prove [n] . Such violations at least deserve d nominal damages

... .” ( internal quotation marks omitted)). Yet “[t]he requirements of Art [ icle ] III are not satisfied merely because a party

... has couched [his] request for forms of relief historically associated with courts of law in terms that have a fa miliar ring to those trained in the legal process.” Valley Forge Christian Coll. v. Ams. United for Separation of Church & State, Inc. , 454 U.S. 464, 471 (1982). More importantly, however, Spokeo and TransUnion put an end to federal courts hearing claims premised on nonexistent injur ies

— regardless of historical pedigree. 6 And the Court’s recently announced “ historical

- analogue test ” does
not suggest otherwise. That test asks whether a modern injury bears a “close relationship ” to a harm traditionally

6 S ee William Baude, Standing in the Shadow of Congress , 201 6 S. C T

. R EV

. 197, 217 (“[I] t is hard to see how nominal damages are fully consistent with the logic of Spokeo . The very premise of nominal damages is that one cannot show any ‘actual injury’ apart from the violation of the legal right itself.” (citing Carey v. Piphus , 435 U.S. 247, 266 (1978)) ).30 No. 20-3134

recognized by common

- law courts. TransUnion , 141 S. Ct. at 2204. It does not, however, transform into a concrete factual injury what the common law has historically regarded as a legal injury

. Put differently , a historical record is no talisman. It is n ecessary, but not sufficient, to satisfy the A rticle III concreteness requirement

. Still, because Dinerstein views Spokeo , TransUnion , and Thole as inapposite, he argues that our prior decision in J.P. Morgan Chase Bank, N.A. v. McDonald , 760 F.3d 646 (7th Cir. 2014), binds us. Relevant here, at issue in J.P. Morgan was whether a bank had standing to block an ongoing arbitration proceeding that t wo investors had initiated after losing approximately a quarter of their initial investment. T he contracts governing the investors’ account s included a forum

- selection clause that required disputes to be brought in either state or federal court. Id. at 649. Seeking to enforce th e forum

- selection provision, the bank sued the investors in federal court . A fter months of litigation, the judge dismissed the bank’s claims for lack of standing. Id. at 650. Reversing the dismissal, we held that the bank had standing to enforce the clause. To form a bilat eral contract, each party must “ take on one or more legally binding obligations ,” we explained. Id. “When one party fails to honor its commitments, the other party to the contract suffers a legal injury sufficient to create standing even where that party

s eems not to have incurred monetary loss or other concrete harm.” Id. at 650 –51. Because the bank had alleged that the investors had “violated the terms of th[eir ] bargain” by selecting an improper dispute

- resolution forum, it had established standing to su e. Id. at 651.No. 20-3134 31

Dinerstein understandably seizes on this favorable language, but he omits the discussion that follows it. We went on to explain in J.P. Morgan that the bank had “a very realfinancial interest in the arbitration” because it was statutorily and contractually obligated to “foot the bill” for the resulting costs. Id. Given th is independent financial interest , the standing question was not merely “o ne of abstract principle ”; it was yet another reason why the bank had standing to sue

. Id.
The concrete harm s present in J.P. Morgan

— being hauled into an improper forum and financing the resulting costs

— distinguish it from this cas e. Moreover, while those harms prevent us from needing to revisit J.P. Morgan , we note that some language in the opinion is in tension with the Supreme Court’s recent decisions in Spokeo and TransUnion . No longer is “a legal injury sufficient to create standing.” J.P. Morgan , 760 F.3d at 651

. “[U]nder Article III, an injury in law is not an injury in fact. Only those plaintiffs who have been concretely harmed ” by a defendant may sue in federal court

. TransUnion , 14 1 S. Ct. at 2205. Any portion of our opinion in J.P. Morgan that suggests otherwise cannot control here. Finally, we recognize that some tension also exists between our analysis here and that of a few of our sister circuits. There is no direct c on flict , however

. For starters, many of the out

- of

- circuit decisions pointing in the other direction predate TransUnion , a watershed decision on the standing doctrine

. See, e.g. , Mitchell v. Blue C ross Blue Shield , 953 F.3d 529, 536 (8th Cir. 2020); Springer , 900 F.3d at 287; Katz v. Pershing, LLC , 672 F.3d 64, 72 (1st Cir. 2012). Of the circuits to consider the issue post

- TransUnion , we understand one to agree with our position , Perry v. Newsom , 18 F.4th 622, 63232 No. 20-3134

(9th Cir. 2021) (“An analogy to a traditionally recognized cause of action does not relieve a complainant of its burden to demonstrate an injury .”); one to leave it unresolved , Glennborough Home owners Ass’n v. U.S. Postal Serv

. , 21 F.4th 410, 415

– 16 (6th Cir. 2021) ( “We need not resolve these thorny questions today ... .”) ; and one to come out the other way , Denning v. Bond Pharmacy, Inc. , 50 F.4th 445, 451 ( 5th Cir. 2022) (“[A] breach of contract is a sufficient injury for standing purposes.”)

. But the Fifth Circuit’s opinion in Denning did not engage with the logic of Spokeo and TransUnion and rested in part on its own precedent

. We therefore do not understand th e Fifth Circuit’s decision to conflict with our own, nor are we inclined to adopt its approach. As we read Thole , TransUnion, and Spokeo , a breach of contract alone

— without any actual harm

— is purely an injury in law, not an injury in fact . And it therefore falls short of the Articl e III requirements for a s uit in federal
court

. C. Remaining Claims
We need not spend much time addressing th e tortious

interference and consumer

- fraud claim s. Both re st on the

same allegations of a privacy, pecuniary, or contractual injur y that we’ve already examined and deemed in sufficient to confer standing. Put simply , Dinerstein seeks to invoke the power of the federal court s to challenge the lawfulness of an event that caused him no harm. But federal courts do not offer “judicial determination[s] that the plaintiffs’ interpretation of the law is correct” ; we resolve cases and controversies. Uzuegbunam , 141 S. Ct. at 804 (Roberts, C.J., dissenting)

. Because Dinerstein has not alleged a plausible, concrete, and actualNo. 20-3134 33

or imminent injury to support his standing to sue , no such case or controversy exists here

. We accordingly modify the judgment to reflect a jurisdictional dismissal for lack of standing . A s modi fied, the judgment is
A FFIRMED

.