The proposal would replace that law with what privacy groups, including the American Civil Liberties Union, have praised as a more flexible approach with stiffer privacy requirements, including encryption of card data and a ban on third-party use of the data.