we can't mandate what organisations do
The government can't mandate what organisations do with citizens medical information?
They can't mandate paying/not paying a ransom to potentially terrorists/banned nation's security services?
Then why do we have a government dept ?