On the recordMarch 30, 2009
So it sounds like what States have done, they have a reporting mechanism that when there is a breach in security and data is compromised, that they are required to notify the consumer that may have been impacted.
Source
congress.gov




