If Congress doesn’t pass a federal privacy law, it will cost over $1 trillion over 10 years, including over $200 billion paid by small businesses