The legislation is sorely needed, but it must not be allowed to weaken privacy protections and cybersecurity