California introduces proposal to expand data breach notification law