The Price of Privacy: Can A Data Breach Cause A Lawsuit?