The notes I had for the Privacy Act were that the guidelines had to be clear around what, when, and how new or modified requirements needed new privacy assessments, and when current ones needed to be updated. We also need to make sure it is enforced. These software tools need to be assessed before being used, and all less invasive methods must be considered beforehand.
On February 15th, 2024. See this statement in context.