New data security legislation could make restaurants take the blame, bear the costs