Both users have access to all the data in that case. It got carried over from iOS which didn't have multi-user support.
(and this is by-design, protection granularity is the volume)