CISA (formerly CISPA) supposedly allows companies to give your personal data to the US government "voluntarily", but "voluntarily" could easily be made mandatory by new regulations — without passing any new laws.