I think the harm in the private sector can be even worse in some contexts than in the public sector. There's probably wider variation.
We recommend empowering the Privacy Commissioner to look into the adoption of intrusive technologies and impose conditions and even moratoria on specific technologies as a meta way of addressing this. We also recommend encoding biometric information as sensitive and explicitly requiring express consent for biometric information as is, I believe, the case in the Illinois law Ms. Bhandari mentioned and in the Quebec law now.
I think those are two good steps and then perhaps even a moratorium. It's just a broader use case.