Passing a law that damages privacy is a negative. Complying with the law is an imperative. So mitigating harm from the law seems like a positive.

It's also not a net negative, if that process is going to be mandatory