A report on assessing the impact of a proposed personal-data protection law shows that data trading, leakage, and collection are rampant and difficult to control.