Is the next big state data privacy regulation heading down the tracks?