At the company I work for, a human being gaining access to “look” at a user’s actual prod data (anything that might contain PII) is super rare and very, very difficult. And I’m not even in Europe. At least a dozen people need to approve the access, including people very senior in leadership, you need to describe exactly what data you need to see, what the business purpose is, what steps you are taking to anonymize the data (can you live with a redacted view?), exactly how long you need that access, how you are going to destroy any copies after that access is finished, and so on. This employee access, IF approved, gets logged and can be scrutinized later. And I have absolutely no doubt if you misused that access it would be noticed and you’d be fired (it has happened). I’m pretty confident that nobody at my company is going on the internet and posting “OMFG LOL our users have such crazy data u should see it LOL.”

I always assumed most SeriousBusiness companies over a certain size, not run by 20 year olds, operate similarly.

▲

weird-eye-issue 38 minutes ago | parent | next [-]

> anything that might contain PII

Sounds like your software might require HIPAA compliance in which case everything that you just said makes sense and is likely required in that context. But for the average SaaS that doesn't need HIPAA compliance it doesn't work like that.

▲

m4rtink an hour ago | parent | prev | next [-]

Yeah, that is the correct behavior what I would expect in a business setting - its a basic decency, not to mention customers switching to competition if they find out their data is not protected.

▲

rcxdude 39 minutes ago | parent | prev [-]

What do you do when you're providing tech support to a customer about an issue that is related to their data? Obviously there should be some process in place but a customer going 'hey could you look at this' is a perfectly valid reason to, you know, look at it.

And it's not particularly unusual to discuss vague details of your customers anonymously. Even in the medical field, with very strict privacy rules, doctors will often publicly discuss encounters they have had with patients, and they only cross the line when they identify the patient.

	▲	ryandrake 30 minutes ago \| parent [-]
		That’s a good question, I honestly have no idea how customer support works. My guess is they have access to heavily audited systems that automate away these approvals, are limited to tools that can delete/reset but can’t read, and/or are given a filtered/redacted window to the user data they do actually need to see with human eyes.