Advocates say companies should be required to notify consumers if their personal information is stolen