New privacy obligations around indirect collection make one thing clearer: agencies cannot treat personal data as administrative exhaust.