I'm not a lawyer, but I think it's pretty crappy that you have to show damages in order to nail someone for negligence. Shouldn't it be enough that they engaged in risky behavior? If I go out on the road and drive in a risky manner, I can end up guilty of all sorts of things without hurting anyone or damaging any property. But give up personally identifiable information (which we know leads to bank fraud) and somehow it's "show damages or GTFO".