The legislators will also continue to dictate what types of security measures must be taken in order to prevent unauthorized access to sensitive company information.

ID theft and security breaches are crimes like any other - they won't completely go away. So we have to try to reduce the amount of data that's at risk.

I support a national notification requirement. But we also need to give companies protection so that if it's obvious they are trying to keep data safe and something happens anyway, they shouldn't be subject to lawsuits.