Shouldn't there also be access control security measures in place that prevent this kind of thing.

E.G., not just anyone can look at seller data, have to have a ticket with some IT group to get limited access to a specific seller's data with a specific reason stated for the access etc.