I very much doubt that there's any real need to be making decisions at that level. The money and other resources going to this IT effort is deeply unlikely to be anywhere close to the pots of money that would be considered for allocation against Russian aggression.

And given that this is in Denmark—which, while certainly within a zone of some concern, is hardly in any imminent danger from Russia—it seems to me that focusing on defending against Russian aggression, at the expense of effectively everything else, would be quite unproductive.

Or is it just that you don't think spending on maintaining privacy is worthwhile no matter what, and the Russia situation is a convenient distraction you can point to?

But here we're talking about giving data about the citizens to private entities in a completely different country.

I can see there being some argument for eliminating the whole idea of "classified information", but that is absolutely not what is being discussed here. This is about the private data of the people of Denmark, and keeping it private.