When you're an organisation the size of Netflix, it is neither necessary nor desirable for all of your staff to be able to see personal data about your users. I

When you're an organisation the size of Netflix, it is neither necessary nor desirable for all of your staff to be able to see personal data about your users. Imagine if anyone working at Facebook or Google could just log in and read every user's posts or mail. Obviously some people will need to be able to access whatever database holds this information for practical reasons, but that access should be restricted to the minimum necessary level and there should be processes and technical measures in place to provide oversight and prevent abuse. This is not only good practice for ethical reasons, it's also a legal requirement in places like the EU. Even the US, not normally known for its strong privacy protections, passed the Video Privacy Protection Act recognising the threat in this area. The fact that apparently someone at Netflix was just trolling through the data in the first place and then felt the need to share it in a derogatory way implies that Netflix do not have adequate controls in place. Something is wrong here: even if the access itself was to some collective/anonymized data set, anyone with the attitude demonstrated by that tweet probably shouldn't have that level of access. As we've seen from Netflix and others before, sometimes even bulk data sets can lead to individual data subjects being identified where this was not the intention.