Commentary on Proposed Model Data Breach Notification Law