As of right now there is not a Federal law describing exactly what is PII data (which would be a prerequisite for this). There are many (48) different state la

As of right now there is not a Federal law describing exactly what is PII data (which would be a prerequisite for this). There are many (48) different state laws that do define what PII is and how organizations (commercial and governmental) are to handle data breach notifications. If you want to see what a crazy patchwork map of laws this is checkout: https://blog.varonis.com/us-state-data-breach-definitions/ https://blog.varonis.com/us-state-data-breach-definitions/ These only come into play if a certain minimum number of state residents have had their data compromised and if that data is of a certain class. Typical classes are: - Account info - Financial info - Health Info - Health Insurance info - DNA - SSN - Biometrics, etc. And I'm not a lawyer, and we likely don't have all the facts, but at first glance the data released in this breach doesn't meet any of those classifications. It looks pretty much like the data you'd get out of a phone book (name, address, phone number) with a few data points like geocoding and their guess as to your religion and politics. Which isn't to say that it's great, or that it's not a problem that this was all released, but it is pretty much public data.