One of the things I fought (using PIAs) was automated warrantless police access to certain records because the data would get shared with foreign border agencie

One of the things I fought (using PIAs) was automated warrantless police access to certain records because the data would get shared with foreign border agencies as part of data agreements, causing the very headaches you imply. I got shared role accounts banned across a sector, and per-user database lookup transaction logs added to a solution so that at least the breadcrumbs would exist. It cost a lot, including my own renewal on the contract, but a couple years later it caught some pretty bad actors. The challenge is that the bad stuff happens to the square pegs first, and tech creates a lot of square pegs. If nobody resists, they apply it generally. Nobody is obligated to be a poster child, and that sucks you have to put up with it.