California implemented breach notification law in 2003, and there are now over 38 states that have similar laws in place. See www.privacyrights.org for more detail on state laws.