A new law in California protects consumers’ "brain data". Some think it doesn’t go far enough.