The proposed data privacy law should also have guidelines on the type of data sought from a customer by a business entity