I think what we're pointing to with both “reasonably foreseeable” and “generally accepted best practices” is to further test the assumption that someone could just say, “Well, I anonymized it. To my mind, it was anonymized.” Then we could say, “But was it reasonably foreseeable that it was anonymized? Did you actually test it against the available technologies and what was out in the field? Then, under generally accepted best practices, did you draw on the very best tools to ensure you were actually rendering it un-reidentifiable?” I think both of those elements do raise the bar, because they suggest yet again that someone can't just throw up their hands and indicate that to their mind it was anonymized.
On April 15th, 2024. See this statement in context.