Recent hacks have shown that the law is lagging when it comes to holding companies accountable.