The new law tightens state control over a wider swath of data and digital activities, raising concern that normal business activity could fall under the broader definition of espionage.