Great decision for many reasons, but one weedy (and important) point jumps out: the court correctly recognized that wrongful disclosure of personal data, even within gov't, confers Article III standing. No need to look at second-order effects: the invasion of privacy is a concrete harm on its own.