California’s new data protection law gives consumers sweeping control over how much personal information companies can collect. But does it really help when companies are breached?