One major problem is that PII/Personal info is uselessly broad. Legislation like this would be much more useful if it had clear rules or fines for various leve

One major problem is that PII/Personal info is uselessly broad. Legislation like this would be much more useful if it had clear rules or fines for various levels of PII. For example, getting your social security number stolen is significantly worse than a stolen e-mail address or phone number. All the notifications about e-mail being "stolen" are just noise that few care about.