I actually like this idea a lot. So the application to get information gets a reply in the form of "no" or the information that was requested, and the requesters can't unilaterally get the info even if they want to.

It's not a perfect solution, but it's the right kind of bureaucratic quagmire to actually make a difference.