There is a difference between making a law that punishes wrongful use of information and then forcing companies to do things a certain way. That's the point here which seems to be missed on most.