Requiring specified business and State entities that own, license, or maintain specified records that include specified personal information of an individual residing in the State to notify specified persons of a breach of the security of a system under specified circumstances; specifying the time at which notification must be given; authorizing notification to be given in a specified manner; etc.