who can sue after a data breach