The whole idea is to make the people who should be keeping the documents private legally responsible, with severe consequences, for taking a specific set of precautions to keep the documents private.
I dislike reasoning by analogy, but if you must have one, it's more like a 16 year old buying beer and then giving it to a 23 year old, who consumes it or gives it to other people over 21.