The U.S. Court of Appeals for the Second Circuit held for the first time that plaintiffs have Article III standing to sue over the unauthorized disclosure of their personal information, even if they have not yet been the victims of identity theft or fraud.