They are numerous, in terms of the fact that when you don't know how data can move and how it can evolve, if you lose control of it and you're allowing people to use it outside of the construct within which people thought it was collected, you can have problems.
One thing that's important to know is that data is so easily replicated and then adapted and moved that losing control over how it's managed or used is a serious risk and creates significant liability. Should there be reasons to have exceptions to these rules? One would hope that those would be made clear and would make sense. The rules are there for a reason. That's a question of process. If there's an exception, why?