This only applies, if you treat privacy as limiting information collected. If you take the view that privacy is a peocess integrity issue instead (all data is effectively personal, the goal is to make sure access to it is transparent and restricted) him asking for such law makes much more sense