Why spend the time now, rather than waiting for future concrete statutes and regulations, particularly in light of the ongoing bills recently proposed at both the state and federal levels (see Speier bill here, Boucher bill here, Washington???s PCI law here, Colorado???s novel data bill here, etc.)?