At last, a privacy bill that starts to take the right approach: limiting the collection and acquisition of data, not merely "protecting" it.