We thought it might be helpful to provide citations to the 37 state (plus D.C. and Puerto Rico) breach notification laws that cover private entities (Oklahoma’s law, that only addresses state agencies, is not included). We also provide links, or uploaded copies, where available.
Colorado (COLO. REV. STAT. § 6-1-716)
District of Columbia (District of Columbia B16-810, D.C. Code § 28-3851)
Georgia (GA. CODE ANN. § 10-1-911)
Idaho (IDAHO CODE ANN. § 28-51-104 et seq.)
Maine (ME. REV. STAT. ANN. tit. 10, §210-B-1346 et seq.)
Montana (MONT. CODE ANN. § 30-14-1704)
Nebraska (NEB. REV. STAT. § 87-801 et seq.)
Oregon (S.B. 583)
Pennsylvania (73 PA. CONS. STAT. ANN. § 2303)
Puerto Rico (Law 111 and Regulation 7207)
Texas (TEX. BUS. & COMM. CODE ANN. § 48.001 et seq.)
Wisconsin (WIS. STAT. § 895.507)
Wyoming (W.S. 40-12-501 through 40-12-509)
For a helpful compilation of state laws addressing credit freezes and Social Security numbers, and proposal federal legislation addressing identity theft, see Congressional Research Service Report for Congress, Identity Theft Laws: State Penalties and Remedies and Pending Federal Bills, June 1, 2007.