The measure creates new rules for a special category of “sensitive” information, including consumers’ genetic data, their sexual orientation and whether they’re a union member.