Mandatory reporting of data breaches