Legal Experts Warn Companies Could Be Held Liable for Poor Data Protection Practices