Any time people question why government (or companies) shouldn’t be trusted with massive centralized databases of PII, point them to this.

Policies can only do so much. If you set a policy, there’s no way to ensure that future users/admins won’t allow violations for convenience, and yes this holds even if you have criminal penalties.

I hate to say it, but the “best practice” in an increasingly hostile environment may look something like Germany’s byzantine systems that don’t communicate directly with one another.