It's pretty expensive to properly invest in data access controls. You need to basically prevent anyone from unilaterally touching customer data without an assi

It's pretty expensive to properly invest in data access controls. You need to basically prevent anyone from unilaterally touching customer data without an assigned ticket (from an customer, alert system, or another employee) or another employee agreeing the access is justified. For very important customers you might want multiple or manager/director level agreement. This can add a lot of friction to normal business-as-usual tasks - if you just grant giant groups of people this access (which is pretty much SOP since so many roles occasionally do need it) then you invariably get this kind of misuse (and leaks).