David Balser explains why a tougher standard for data-breach victims to prove how their leaked personal data caused “tangible harm” has not kept them from filing thousands of lawsuits at a rapid pace