All companies to report privacy breaches under new bill but no big penalties if firms own up