Re: We need to borrow from the Nuremberg playbook
And make individuals working for government personally liable for any crimes they commit, even if they are explicitly ordered to commit them.
I'm rather on the fence about that - being a government employee myself.
As an absolute offence/punishment, I disagree. It's easy to use an extreme example to make bad law - c.f. some of the bad "think about the childrun" justified laws. And often it's not clear to the person involved that something is wrong.
So lets say I'm a junior admin, and given a list of people to give access to. I might question it, but if I'm assured by people at a higher pay grade that people at the relevant level attest that the access is justified (need to know, security measure in place, training, etc.) then I'm probably not in a position to know otherwise - how do I as a junior admin know (for example) whether someone has a need to know for their work about which I know nothing ?
So in a case like this, a reasonable defence would be that you'd questioned it, and had plausible assurances that everything is in order - note the "plausible" bit there.
In (from my vague recollection of Nuremburg), any "I checked and was given plausible assurances it was legal" defence was implausible - to a "reasonable person", an order along the lines of "go off and kill [some group], it's all OK and legal" would not be plausible. But an order "give these people access to [system], they have a need to know, there are security/privacy provisions in place, and they have been trained" is likely to be plausible to a junior admin who won't have the visibility to say those statements aren't true. In my own line of work, we're a sizeable organisation, and a lot of information is "need to know" - so I frequently have to take information I am given at face value as I don't have a need to know about the details it was derived from (I do have a route to question anything I might be cautious about though).