We need legislation which deals with the reality of the PII loophole. While the ACR data on its own may not identify me/my household, it absolutely does once it's combined with the rest of my fingerprint in the cloud.