It's rather lengthy and contains lots of repeated verbiage but I didn't see anywhere in it penalties for unauthorized access or leaking of the PII collected. It lists the purpose for collecting the data, what they intend to use it for, and states it cannot be used for purposes other than those listed in the bill but without consequences for violating those provisions, there's little reason for the organizations who are given access to this data to treat it with respect and secure it appropriately.