It should be illegal for the government to do so, further make it illegal for businesses to do so AND for city, county, state, federal governments to utilize third party databases.
This is a very under-appreciated concept.
Local control and storage should be a requirement.
I really do. A centralised, insecure [1] database could lead to America losing a war.
A distributed system of low-reliability nodes is more robust than a centralised system that's very reliable. "ARPANET," after all "was built to explore technologies related to building a military command-and-control network that could survive a nuclear attack." (That's not what it wound up becoming.)
[1] https://techcrunch.com/2025/11/03/lawmakers-say-stolen-polic...