In the absence of a federal data privacy law, a handful of enforcement agencies—both state and federal—are taking stabs at a national data security framework in their own ways.