Once you build nuclear weapons, then you have to maintain them, and hope the required budget will remain in the future, and that corruption will not disrupt the processes involved.
Once you create repositories collecting data on third parties, you similarly will have to ensure that they will be protected against leaks - that the state may keep track just to be sure does not mean you would ever accept to live in glass walls.
Responsibility wise, if you gave a credit card number to a vendor, you trusted his security measures against leaking, but how about data that was copied without your consent? Who has access, how is it protected, who is responsible?
(Just one of the possible points.)