On legally mandating "adequate encryption"

When I see stuff like this:

Consumer data security bill passes out of House committee: "Data encryption is the only technology specified in the bill, and adequate encryption could exempt a company from the need to notify victims. "

I always wonder whether ROT13 is "adequate encryption" based on the letter of the law.