First of all, screw this attitude of "prove it in court". If you or your company is so sociopathic that you can't see the wrong here, well, just screw.

Second the problem statement I made above itself shows harm.

The fact that consumers have to worry about who got their private information, what was done with it, what harms happened that they aren't aware of, such as not getting a job, housing discrimination, loan discrimination, etc. is itself a harm.

That these things happen, in general, is eminently provable and that fact causes worry, anxiety, and changes in behavior which is itself a harm.