While I would love for something like this to move forward, I think the focus in this bill takes a weird turn. E.g. the definition for "High-Risk Information System" includes as one its 4 criteria:

> involves the personal information of a significant number of consumers regarding race, color, national origin, political opinions, religion, trade union membership, genetic data, biometric data, health, gender, gender identity, sexuality, sexual orientation, criminal convictions, or arrests;

Systems that allow for discrimination against protected classes are certainly high risk, but I think most of us are more concerned by the identify theft risk online, and more likely to be discriminated against in person.

But the bill does _not_ anywhere mention addresses, social security numbers, banking information, etc. Maybe those things would reasonably be included under one of the other criteria:

> taking into account the novelty of the technology used and the nature, scope, context, and purpose of the information system, poses a significant risk to the privacy or security of personal information of consumers;

Separately they define Personal Information as:

> The term “personal information” means any information, regardless of how the information is collected, inferred, or obtained that is reasonably linkable to a specific consumer or consumer device.

That seems like a reasonable definition, but I think an "including but not limited to" list would have been helpful.