Cyber security and data protection: learning from your own mistakes is good, learning from somebody else’s mistakes is better — the reasons underpinning fines and what regulators expect of cyber security