I believe that's true. I believe that what's left to be prescribed in regulations is not what kinds of information can be collected, but from where and from whom and then how. It is my understanding that you would have to amend the legislation for different kinds of information.
On October 5th, 2017. See this statement in context.