New York joined four other states that have expanded the definition of a breach to include not just unauthorized usage of private data but to include access to the data. 

With a thunderous silence at the Federal Executive and Legislative branches on how to handle consumer data privacy and the consequences of exposed data, states are stepping in. 

California, by itself the world's sixth-largest economy, came up with the CCPA, its own version of GDPR. Others are following, with New York just the latest: Massachusetts, Arkansas, Puerto Rico, New Jersey, Connecticut, and Florida already have updated, more stringent laws on the books, and others are following suit rapidly.