Trust relocation

What actually happens when an institution takes custody of its own database. The set of parties who can read the material does not shrink, and no adversary is added to or removed from the threat model. What changes is the kind of constraint on the party best placed to read all of it, which moves from a technical control enforced at the moment of the query to a legal obligation enforced after the fact. The exposure created by that move lands on the people whose material is held, who did not choose the tier and in most cases are not told which one they are under. Not an argument against sovereignty, which is often the right choice, but a bound on what the word alone establishes.