Absolutely not if it excludes the govt. they have more breaches than the private sector, for one, but more importantly- NO law should be enacted that doesn't require the govt to meet the same standards. Secondly, there are already rules in place that require notifications. We don't need another law that will require a team of lawyers to understand. If there is criminal negligence- only then should any level of govt get involved.