can you sue for a data breach