Lawyer here. In most countries, such terms would be set aside on the grounds of being unconscionable and against public policy. The consumers have no real bargaining power in the setting of the terms here and lack the sophistication necessary to understand that they are waving their legal rights. If you are going to make someone waive their rights you need to get not merely their consent, but 'informed consent'. Additionally, it is the companies duty to inform people if their data was stolen and can't make them agree to some self-serving terms before it does so.

Despite the SCOTUS ruling in AT&T Mobility LLC v. Concepcion if this question is put before a US judge, there's a good chance that the contract won't be worth the paper its printed on.