who is responsible for a data breach