I think so.
I have three points on that.
The introduction of the concept of “best practices” temporarily provides clear standards on how to properly anonymize data. It is specified in the regulations to provide clear standards on the use of the data and to provide guidance to the commissioner.
It's also possible that the commissioner, through the actions he'll take to enforce the act, will contribute to the evolution of these concepts in all facets of the bill. The commissioner also has the ability to influence the definition of these concepts.
That happens all the time, in the sense that with enforcement actions comes even further precision about how this will be understood. At the outset, there will be a commitment to use the best technology available. That will, then, get laid out in the regulation-making process, which is consultative by nature, and then further established in enforcement.