The principle of least privilege should always be used where possible. If you don’t need to access information, you really shouldn’t even have the option, at least not without either the client/customer’s approval, or a managers authorisation

Nice idea in theory, but imagine you had a bank or energy account and had to call customer service. If the agent has to get approval to access every account, that would be so, so time consuming, the company wouldn’t have clients/customers. There isn’t enough managers on the floor or available for that to be feasible. So they drill into us phone monkeys that we are not to access that kind of data (celebrities, people we know). The authorisation to access comes from the customer calling in, and asking for an action or info on their account. This is also why, in the back end, everything is logged: the date and time, which agent, whether a note was left, what the interaction was for, etc. We are told, over and over, not to do it, with Privacy Act citations.

Besides, there are preventions in place. Example: I was trained, at one point, to deal with only residential customers. I could not access Small-to-Medium business accounts, nor Large Business accounts. When I was promoted, that’s when further training was provided and my access upgraded. Again, everything is logged, and every phone monkey KNOWS it’s illegal to access that info without a customer asking, or without a manager asking. I had to access Large Business accounts without a customer telling me to, because I was doing remittance. I’m talking over $1m in one payment from one company.

The phone monkeys know it’s wrong without authorisation. I promise you they KNOW. It’s on them at that point and they should expect at least a firing, if not legal action.