The government is not allowed to collect data on citizens. How should the act be updated to make it better and more value-added for the public-private partnership in regards to cybersecurity?

The government is not allowed to collect data on citizens. How  should the act be updated to make it better and more value-added for the  public-private partnership in regards to cybersecurity?