These risks apply to every Services Australia product. They are legal obligations and corporate practices that individual products cannot override. A subsidiary cannot opt out of an FTC consent decree. A company cannot selectively ignore its home country's intelligence law for one product. These risks set a grade floor of C — no Services Australia product can score better than this, regardless of its own privacy settings.