UCITA::="Uniform Compute Information Transactions Act", recommended to states but passed(2003) by only two: VI & MD, protects vendors from being sued if the software fails. Vendors can specify which state law will apply in their acceptance contract.
California law: "Security Breach Information Act" July 2003. Businesses must promptly notify customers when reasonable suspicion f unencrypted personally identifiable data is accesses in bad faith----civil damage$$$