Agenda item 7 – Data breach notifications – lessons learned