You seem to have a lot of faith in the law and legal process, and assume everyone else does.

Laws are a high latency side-chain of authority; a guide perhaps; and for some a business opportunity.

And then we have Organised Crime, moles, plants; informants, sympathesiers, casual snitches, quadruple agents, the desperate, and machine learning eating meta-data for breakfast.

If you've got something to hide "it's not legal for support staff to [whatever]" is most definitely not a security measure.