Should companies be held responsible for a customer data breach?