"Citizens don't have the authority to say no. Given that backdrop, I think states have a greater responsibility to protect those types of information," Nevada CISO Chris Ipsen says.