I would say the theory you've described is accurate. Where we choose to apply it may not be with personal information first. For example, the business number is something that we've agreed on. There is a central registry for a business number, so we may want to start there. We may want to start with unclassified...well, no, I promise you we will also start with unclassified information first. We could crawl before walking.
On February 19th, 2019. See this statement in context.