Businesses are required to make timely notification to consumers that their private information may have been illegally accessed following a data breach as mandated by:

A. most large city councils
B. Health and Human Services
C. various state legislatures
D. the EPA