Proposed Law Would Criminalize Failures to Report Data Breaches