How confident are you that the government could accurately assess the risk of any technology? Why couldn't I just write the same risks for any given social networking site and copy-paste it every single time I was faced with a compliance form like the one you described. This all just sounds like an exercise in pointless box ticking but that just might be my deep skepticism of governments talking.