Hacker News Reader

Sure, but it comes at a cost. Companies rarely push the limits of these kinds of policies because customers are not willing to pay for them.

Making the penalties for breaches far more severe would be a good place to start though.

Twitter is big enough to pay that cost. Easily.

The absolute minimum number of people may still be significant

Twitter has a lot of staff. Even 1% is a relatively large amount of people.

Moreover, anyone seeking privileged access will percolate into such roles.

(Just as an FYI, the last time I checked that number was staggeringly skewed towards sales/marketing/evangelism teams rather than coders. Not that your point is diminished.)

Those people probably have more access to PII than staff engineers - that's who the data is for.

Hardly. They get the filtered data that SEs designed for them to get, probably on an account-by-account basis. It’s the raw data SEs have access to that we are mainly talking about here.

It doesn't need to be 1% of staff, it just needs to be a few dozen people (distributed geographically across the globe) who have root access.