From the conclusion:
U) Third, as part of this set of policies and procedures, and/or as a complement to it, the IC (Intelligence Community) should develop more precise sensitivity and privacy-protecting guidance for CAI (Commercially Available Information). Again, we offer several suggestions for the development of such guidance.
So, in some light this should be considered progress, not the 800lb gorilla in the room.