11. Nothing in P.L.2023, c.266 (C.56:8-166.4 et seq.) shall require a controller to:
 
   a.   re-identify de-identified data;
 
   b.   collect, retain, use, link, or combine personal data concerning a consumer that it would not otherwise collect, retain, use, link, or combine in the ordinary course of business.
 
L.2023, c.266, s.11.