As I noted, reasonably foreseeable has been included in a number of statutes, but it has a strong interpretive value that's been added to the existing private sector privacy law in PIPEDA. It appears there many times and is understood as a construct that can be tested by both regulators and courts as to whether or not it was understood by the individual at the time and whether or not they had taken appropriate measures to anonymize the information.
On April 15th, 2024. See this statement in context.