I guess the audit system is there, it's just a lot of log files. That's a point where they could use simple rules or ML to flag up possible misuse. E.g. support

I guess the audit system is there, it's just a lot of log files. That's a point where they could use simple rules or ML to flag up possible misuse. E.g. support staff accessing profiles that aren't related to a ticket they were working on. Or a developer tracking a single rider/driver with same last name or address (or really any developer getting data for one rider only). Won't have a 100% success rate but I guess it could prevent most cases of abuse. It's not that different from what banks do to detect internal fraud.