State legislatures around the country continue to enact stronger and stronger data breach laws to protect their citizens against unlawful use of personal information. The two latest actions are in California and Massachusetts. See the Workplace Privacy Report to learn more about the new bills.
Massachusetts already has one of the toughest data security laws. Most other states have regulations that require public notification of data breaches and allow for civil or criminal penalties. Many, but not all of them, provide safe harbor from penalties if the data was properly encrypted.