Defending against breaches.

• Author: Greenberg, Pam
• Position: STATESTATS

It's not if, but when.

With the enormous amount of personal data Americans are sharing online and businesses are amassing, experts agree that it's just a matter of time before hackers and cyber thieves get their hands on all that treasure.

Legislatures have worked to protect citizens by passing laws that require businesses with computerized personal information to notify customers if that information is leaked or accessed without authorization. The laws also allow consumers to monitor their records or close their credit card accounts to protect themselves against theft and fraud. Many credit these data breach laws with prompting better security practices among businesses--such as encryption, which makes documents unreadable except to the intended recipient.

Still, data intrusions continue. The credit reporting agency Experian predicts thieves will be focusing more on usernames and passwords stored in the cloud this year, as well as patients' confidential health information.

This increased vulnerability has lawmakers searching for ways to improve upon the laws already on the books to make them more effective. California expanded its law requiring reasonable security practices to include businesses that maintain--not just own or license--personal information. Kansas, Louisiana, West Virginia and Wyoming expanded notification requirements to educational institutions. Florida amended its law to include...