Qantas failed to protect passengers’ personal information, according to a law firm pushing for compensation from the airline after a major data breach.