; (iv) the fact that non-sensitive personal data, when analyzed in the aggregate, can reveal sensitive personal data; (v) the commercial availability of inferred and derived data; and (vi) the potential for especially significant harm from data and inferences related to sensitive domains, such as health, work, education, criminal justice, and finance. (6) Notice and comment period The Secretary shall provide for a public notice and comment period after the publication in the Federal Register of a proposed rule, and before the publication of a final rule— (A) identifying the initial list of categories of personal data under subparagraph (A) of paragraph (2); (B) adding categories to, removing categories from, or modifying categories on, that list under subparagraph (B) of that paragraph; (C) establishing or updating the threshold under paragraph (3)