Well, there's the issue of "can you really protect the data?" and then there's "who would you most trust to protect it?". Maybe you can make the case for Google in the second scenario, but if course you can't *really^ protect the data.

So, then it becomes, "what can be done to reduce the amount of data collected and the risk it isn't protected?"

That's where this law appears to be a step backwards.