Two bills designed to protect "covered critical infrastructure" against cyber attacks by terrorists and others should remain focused on their key purpose and not be expanded to include data breach legislation or broad new privacy regimes, the National Retail Federation said.