How do they define what "selling personal data" means? Does that mean the the law affects equifax and not facebook for example? and what if a company which collects data is sold to another company or its assets were sold during bankruptcy does that count as selling personal data?