Bryan Cave provides a summary analysis of litigation in terms of what kinds of claims tend to fail to demonstrate standing in class action lawsuits and what types of claims may be sufficient to demonstrate standing.
What they don’t show on either side of their chart is the question of “are the data involved highly embarrassing/stigmatizing?” What have courts held when there’s no demonstration of identity theft or misuse of data but the data involved are highly sensitive medical or psychiatric details?