InformationWeek just came out with an excellent treatise on a new data protection law in Massachusetts (note – the link is an excerpt, but you may access the entire article if you're willing to register). In my opinion, this is a must-read. Here's an excerpt of the preamble:
"The new Massachusetts data security law, 201 CMR
17.00, is a prime example of the increasingly aggressive role states are
taking to protect their citizens. More than 40 states have data breach
notification laws already on the books–a trend that started with
California's SB 1386 but certainly didn't end there. Much like those
other laws, Massachusetts' has impact beyond the state's borders and
could spur similar legislation in other states.
Federal action is also a distinct possibility."
If that doesn't whet your appetite to continue reading, I don't know what will…