Some regard a new state data breach law as a model, others see it as too strict.