My answer to that would be pay attention to the provisions that define purposes for which businesses can use information. Right now, I think it is fairly open-ended. There are not many, if any, limitations, except under proposed section 12.
If the provisions that define original purposes or new purposes were to say that only specific and explicit purposes are lawful, then I think that would be a step forward.