I think defending against internal abuse is always an uphill task. The key thing is to have auditability - store records of who accessed what and when and make

I think defending against internal abuse is always an uphill task. The key thing is to have auditability - store records of who accessed what and when and make sure those records can't be tampered with. The knowledge that that data is being generated acts as a major deterrent (apart from being a forensic tool)