The "we have policies" defense is complete horse manure for the reason you stated and also because if those policies are secret, as is the case with regards to wholesale surveillance state policies, there is no way to verify they're being followed or hold anyone accountable for violating those policies.

Additionally even when governments don't change the policies have an uncanny habit of not being followed whenever it's convenient to ignore them. That has happened time and time again.