"...mandate that companies must inform citizens when they obtain or possess their private data so people can see the whole picture of who has their private information and how that network grows."

I would add the actual data collected and shared to this information. Simply knowing that information was collected and shared is not particularly useful without knowing what data was collected and shared.

Thanks!