There are some state laws - California, Virginia and Colorado, a bunch of others. And the SECURE Data Act currently in Congress. https://statescoop.com/house-subcommittee-secure-data-act-pr...