I believe notification was one of the ones the commissioner recommended. We added the general duty to protect personal information and the issue respecting data matching, if my recollection is correct.
On June 3rd, 2008. See this statement in context.