Should one be able to prevail in data privacy litigation just because they can show their biometric data was collected in violation of a statute—without sustaining any injury?