> I’m wondering: is there a good list of data privacy failure consequences?
The ultimate example is how 1940’s Germany used 1930’s Germany’s census data. In 1933 it didn’t seem so bad to tick a box with your religious affiliation …
The Netherlands as well. Dutch census religious affiliation data were used by the imposed regime 1940--45.
Several Dutch officials enacted wholesale destruction of those records as the occupation became obviously imminent, which saved many, though the Jewish population of the Netherlands fell from 154,887 in 1941 to 14,346 in 1947.
The point being it's not necessarily your own government you need be worried about.
In another variant on this, surveillance records kept by the East German Ministry for State Security (Ministerium für Staatssicherheit, a/k/a the Stasi) and Soviet KGB were acquired by successor governments (unified German and post-Soviet states including Ukraine). See: <https://www.wilsoncenter.org/blog-post/unearthing-soviet-sec...>
(I'm trying without success to find a reference to the destruction of Dutch census records, though I'm pretty certain this did actually happen.)
There was a dedicated effort by the Dutch resistance to destroy the records of the civil registries. During the occupation, forged documents could be checked against the records in the civil registry. By bombing the civil registry office, the forged papers could no longer be validated against the civil registry, and would pass inspection.
The ultimate example is how 1940’s Germany used 1930’s Germany’s census data. In 1933 it didn’t seem so bad to tick a box with your religious affiliation …