I have been a fan of Daniel Solove’s approach to privacy, where he foregrounds actual harms suffered by individuals rather than derive remedies from abstract principles. I have often said that the informed-consent model is of zero value when people find that their personally identifiable information stored by an organization has been stolen. The US Federal Trade Commission has called for comments on informational harms or injuries. I am tempted to respond. Would if there were 28 hours in a day.