What purposes do data breach notification laws serve? Are there any additional categories of personal information that you believe should be covered by state breach notice laws? Most states have a risk-of-harm exception for breach notification laws, while some do not. Which is the best public policy, and why? If hackers breach a company's system that contains personal information, but there is no evidence that they have downloaded any of the information, is the company required to issue breach notifications? Compare and contrast the requirements of the data security laws in Oregon, Rhode Island, Nevada, and Massachusetts.