The state can get an injunction against you, fine you, and in some situations creates a private cause of action for the people whose information was breached to individually sue you with statutory damages available.