I realise this is a controversial opinion, but tbh I reckon some of the blame for these kind of things needs to rest on the company, too. The principle of least privilege should always be used where possible. If you donât need to access information, you really shouldnât even have the option, at least not without either the client/customerâs approval, or a managers authorisation
Humans are curious things, itâs bounds to happen. Firing people after it does is a reactionary response, not a preventative one. And prevention is better than cure, especially when it comes to personal information
(My perspective comes mostly from being in care, because pretty much every single piece of information about me, including things often said in confidence, lives in a little grey box with no transparency about what goes on or who has access. And there have been data breaches in the past, where people from certain organisations managed to gain access to the files for clients within completely separate organisations, with multiple instances of support workers using that access to do terrible things. I wasnât involved in that, and have never even worked with that organisation, but itâs still something that used to play on my mind a lot and made me quite upset and worried. I realise that my views are probably a little OTT for certain industries that handle less confidential information, but that are still covered under the privacy Act. I still believe all systems handling PII should always use the principle of least privilege and fail safe, though)
Llabyrinthine@aussie.zone â¨1⊠â¨month⊠ago
Yeah, I remember years back someone phone up a radio station saying that a well known celebrity claimed their cosmetic surgery as medical procedures. Itâs like dumbass, someone will recognise your voice.
The level of entitlement to know peopleâs personal information is mind boggling.
StudChud@aussie.zone â¨1⊠â¨month⊠ago
Itâs so stupid and audacious đ like, the company will have ways to find whether you accessed data in good faith, and will kick you to the curb if you didnât note the account with a good reason as to why it was accessed. People have been seriously injured and died from assholed accessing data to find where they live. Itâs protection that should never be violated.
Like, we were even told not to access our own accounts, or accounts of people we know. If we got a call from someone we knew, we had to transfer it to a different consultant.
Like, what goes through these peopleâs heads that they think they wonât be caught and sacked? I donât get it đ