Several states followed, and today, nearly every state has a data breach notification law.
States have picked up some of the slack, passing many breach notification bills.
Chris Gaither, a Google spokesman, said his company was "engaging on important issues" like security breach notification and declined to comment on consumer privacy legislation.
Half of identity fraud victims in 2012 had also received a data breach notification in the same year, a new report from Javelin Strategy & Research finds.
Stroz Friedberg recently found that data breaches remain largely hidden – why is this, and is it about time for some data breach notification laws?
Britain, Germany and France all have different forms of mandatory data breach notification laws that require individuals affected by data breaches to be informed.
The acting Australian information commissioner, Timothy Pilgrim, welcomed the draft bill and said he strongly supported the development of mandatory data breach notification provisions.
"We need a uniform national standard for data security and data breach notification," said Representative Mary Bono Mack, a California Republican who is pushing for legislation on better consumer safeguards.
But he added that there is "every prospect" that data breach notification will become a legal requirement for organisations, both for notifying individuals affected by such breaches and informing the ICO.
Enforcement bodies can also essentially override a direction from the Australian privacy commissioner to make a data breach notification by issuing a certificate if the chief executive officer believes the directions would be prejudicial to their activities.
The Joint Parliamentary Committee on Intelligence and Security recommended in favour of the introduction of a data breach notification scheme, but this was not part of the data retention legislation that passed the Senate last week.
