This is good, but also leads to the obvious follow up question of how stringently it has and will be enforced. It's also illegal to lose PII and credit info for millions of people but, well, here we are.
Also, parallel construction. Also, data laundering - you drop DNA test data into a business analytics third party, and two data brokers later this arrives at your insurance company as a personal profile "created from data about your shopping habits collected on-line and off-line", or something like this. Don't know for sure if that's actually happening, but I assume it is.
