What do you do when you're providing tech support to a customer about an issue that is related to their data? Obviously there should be some process in place but a customer going 'hey could you look at this' is a perfectly valid reason to, you know, look at it.

And it's not particularly unusual to discuss vague details of your customers anonymously. Even in the medical field, with very strict privacy rules, doctors will often publicly discuss encounters they have had with patients, and they only cross the line when they identify the patient.

That’s a good question, I honestly have no idea how customer support works. My guess is they have access to heavily audited systems that automate away these approvals, are limited to tools that can delete/reset but can’t read, and/or are given a filtered/redacted window to the user data they do actually need to see with human eyes.