State Regulations

California SB 1386 Personal information: privacy.
http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=200120020SB1386

This bill, operative July 1, 2003, would require a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the data, as defined, to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Massachusetts 201 CMR 17.00 statute
http://en.wikipedia.org/wiki/201_CMR_17.00

Requires that any companies or persons who store or use personal information (PI) about a Massachusetts resident develop a written, regularly audited plan to protect personal information.