This is why our policy at Fog Creek is to explicitly get permission from users before accessing their data. It's enforced by the sys admins (which we screen more extensively during the hiring process), who give temporary access to the person who needs it once the user has given their permission. When we're done, the sys admins remove access to that account again.

It's a pretty painless process (we have snippets to ask permission from the user and shortcuts to request access from the sys admins) and it helps prevent both willful and accidental leakage or modification of our users' data.