Not sure about the US laws, but in South Africa we have the Protection of Personal Information Act (Popi) and it became law on November 26 2013.
"Popi essentially regulates how anyone who processes personal information must handle, keep and secure that information.
Personal Information broadly means any information relating to an identifiable, living natural person or juristic person (companies, CC’s etc.) and includes, but is not limited to:
contact details: email, telephone, address etc. demographic information: age, sex, race, birth date, ethnicity etc. history: employment, financial, educational, criminal, medical history biometric information: blood type etc. opinions of and about the person private correspondence etc."