recent data breaches spark debate reasonable notification rules lawsuit file pennsylvania los angeles chicago draw attention vague language state law define quickly consumer inform data breach discover