State laws requiring businesses to notify individuals and authorities of data breaches involving personal information.