That clause could provide a big loophole for companies and possibly result in incidents such as the one involving TransUnion to go unreported in the future, warned Alan Paller, director of the SANS Institute, a security research and training firm in Bethesda, Md.

"I believe that 98 percent of the time companies are not going to disclose breaches" if the law goes into effect, Paller said. "Only 2 percent are going to be good citizens and report breaches" even if there is nothing to suggest imminent fraud, he added.