data breach notification coverage