more business-friendly versions with limited private rights of action - **Montana, Oregon** — include stronger protections for sensitive data