[tdeck]

> and inadvertently accessed a system in a way he didn't realized was a privacy violation

Sounds like they need better controls, there shouldn't be ways to inadvertently access personal data and violate someone's privacy. Particularly not at such a mature company.

[jasonfarnon]

I don't work there but I imagine when this happens it's because the employee needs access to the resource for some legit reasons, but accessing it for illegitimate reason is what amounts to the violation. So access controls here would amount to reviewing the reasons for the access.

[leokennis]

Solution would then be to ask for and log the reason for the access. Possibly with an approval needed by a second person. You can still lie about why you need access, but at least it is logged then.

[jasonfarnon]

I'm sure they do this--but the rogue employee still gets access and OP was saying access should be prevented in the first instance.

[loeg]

Meta does this.

[loeg]

The controls have gotten better / more explicit over time. They flash you up a pretty explicit clickthrough wall now. And there's pretty explicit training that you hand off issues for friends/family to a 3rd party engineer to handle rather than accessing user/friend data yourself.

[tdeck]

When I worked at Google it was literally impossible to access personal data like this in most roles, even for my own account. So it seems like meta leaves something to be desired if it's a click through and a policy.

[loeg]

Maybe? I don't think engineers are likely to "inadvertently" access data inappropriately with either policy.