is there another way of saying that the Notifable data breach scheme is not specific enough in its law

The Notification Data Breach Scheme lacks clarity and specificity in its legislation.