There will always be such employees, which is why actually privacy-minded companies strictly limits access to personal information, and carefully monitors the access of it.
It would be even better if that data was not collected to begin with. Alternatively, that this data would not leave the local hardware. But no.. everything has to be connected.
You're right of course. The very best way to restricts employee access to personal information is to never have it in the first place.
... Which is why companies that are ran by adults have access controls and audits for user data.
Ones that aren't ran by adults get sued, and deserve everything they get coming to them.
Not putting appropriate access controls around that data is a choice and one that I hope they end up paying dearly for in court.