Data breach plaintiffs suing in federal court must demonstrate that they suffered an injury-in-fact to establish the "'irreducible constitutional minimum' of standing."  Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)).  Such plaintiffs often invoke privacy harms that they allege are similar to common law "invasion of privacy," following the Supreme Court's "close relationship" test articulated in Spokeo and TransUnion L.L.C. v. Ramirez, 594 U.S. 413 (2021).