Corporations need to do more to protect investors from the financial damages of data beaches, an SEC commissioner says.