They have to do one of two things:<p>1. They can establish and run a process that ensures that data doesn&#x27;t have personally identifying information in it. For instance, they can have a process by which they sign off on the types of things they&#x27;re willing to share, and share only the stuff that never has PII in it.<p>2. They can instead run software that tries to spot PII and zaps it before sharing it.<p>I don&#x27;t know how people can take EFF seriously when they say things like &quot;aggressive spying powers&quot;. Whatever &quot;spying powers&quot; are in this bill are subtle; I don&#x27;t think they&#x27;re there at all. EFF does this a lot: they know their readers aren&#x27;t going to read the bill, and further that their readers <i>want to believe</i> that the bill is horrifying, and they play that to the hilt.