The conceptual and operational compatibility of data breach notification and information privacy laws