To require notification following a breach of security of a system containing personal information, and for other purposes.