There is huge pressure from industry to get Congress to preempt state data breach notice laws. It's quite a mess now.
No one wants to send out a security breach notice. You instantly become a pariah, and the fear is that you'll start to lose customers.