Richard Blumenthal actually said...

my bill would provide for mandatory notification

That kind of basic principle is the bedrock of this legislation, a standard of care applied industrywide, and enforcement.

Am I right in thinking that the United States is behind a lot of the rest of the world in its data security safeguards?

I would urge that he take whatever action is possible, as he has done in a number of steps already.