Data breach prosecutions 'very rare,' expert says