Handling security breaches from a German law perspective