States begin taking data protection seriously