“The SECURE Data Act adopts a weak data minimization standard that allows companies to continue existing data practices as long as they are disclosed in a privacy policy.”