If and when ...
This Bill puts the cart before the horse.
There is a natural distinction between:
1) Data collected by Government in anticipation of security needs, never to be disclosed, and
2) Data collected by Government for operational purposes to provide Public Services, and disclosed as statistics.
There is no such distinction for extra-Government data collection. Yes, I mean Google, Facebook, et al..
Until a voluntary, coherent policy (a rigid Social Contract) comes forth from the Service Provider parts of Government not to disclose individual information on the citizens, the model by default will be the same as data collection by extra-Government entities.
Otherwise, Big Brother will perish with the outsourcing of the Fall of the (Roman, etc.) Empire ("Run the Government just like a Business") and a Dark Ages of no privacy with an unending harassment by predators (Yes, I mean Google, Facebook, et al..) in search of resources (that would be us) is sure to follow.
If you ask me, we need Big Brother to get his fat ass off the couch and help with this one.