Three more states add laws on data breaches