The highs and lows of data breach notification regulation across states in the US.