Even in pretty dysfunctional countries, or pro-business ones like the US, where nothing like the GDPR exists, telcos management have a strong interest in not letting just any rank and file employee spy on subscribers.

Most breaches are not in the interests of management, but they happen anyway as management wants to save money or doesn't understand how it could happen.