A. A definition of what constitutes reasonable security practices.

B. A requirement for the creation of a data protection authority.

C. A list of cases in which privacy policies are not necessary.

D. A clarification regarding the role of non-automated data.