Proposed law would jail execs who fail to report data breaches