When private sector entities fail to protect individuals’ data, the State must be equipped to respond swiftly.