One downside I see is enumerating what is considered personal data vs not. In general, I would consider any information about a person, based on that person’s activity, or created by a person to be personal, but I think there’s a lot of good ideas here.
I came up with another policy suggestion that I think would strongly and concisely protect digital privacy and wanted to link it here as part of the general privacy discussion.