Do we need tougher breach notification rules?