Legal Lessons of Data Breaches