Regulators in New York and California are stepping up their notice requirements for security incidents. California is also in the process of enhancing consumer data rights.