What are the legal implications of a data breach