FindLaw.com have the following story:
"In a legal decision that could have broad implications for financial institutions, a court has ruled recently that a student loan company was not negligent and did not have a duty under the Gramm-Leach-Bliley statute to encrypt a customer database on a laptop computer that fell into the wrong hands."

SecurityFocus.com's Mark Rash has an excellent article about this decision[PFD].