Victims of privacy breaches must demonstrate actual loss and damage to be eligible for compensation, according to a judge who has given asylum seekers who secured a ruling from the Privacy Commissioner a second chance at proving loss from theĀ public disclosure of their personal information.