Washington, D.C. Adds Security Requirements in New Data Breach Notification Law