First, we include a list. Second, we're adding “but is not limited to”, for a very simple reason, which is that if this legislation had been in place 10 years ago, biometric data would not have been included. We would not have thought about it. Technology is changing rapidly.
The Supreme Court's interpretation of “reasonable expectation of privacy” is, as I understand it, subject to a legal test. We are introducing the notion of a “high expectation of privacy”. This concept could be interpreted later by the courts so as to expand the list as changes occur in the environment in which consumers and citizens operate.
In principle, this would enable the courts to interpret the notion of “high expectation of privacy” and expand the list as needed.
However, I don't think that it would change the minister's regulatory authority.