I'm pretty sure unless the system is based on minimum-privilege strict audit (with audit logs regularly reviewed by a dedicated inspector team) - which I never

I'm pretty sure unless the system is based on minimum-privilege strict audit (with audit logs regularly reviewed by a dedicated inspector team) - which I never ever seen happening anywhere - somebody out of lots of people that have access will be tempted. And the reason why most of "unicorns" likely do not have strict audit system for PI is because it costs many $$$$ but brings exactly $0 in revenue. And until it becomes many $$$$ in potential lawsuit liability exposure, it will continue so, because nobody would invest serious effort in something that is only hurting the bottom line.