A cybersecurity expert discusses breaches, data protection laws, and why he considers multi-factor authentication the beginning of security