CFAA now is about violating technical controls, not policy controls. If policy says "Don't look at HR data", but nothing technically stops you from looking, it'

CFAA now is about violating technical controls, not policy controls. If policy says "Don't look at HR data", but nothing technically stops you from looking, it's not a CFAA violation to look.