Just applying the same rules should work if we ignore the "database could be hacked" argument: you can collect the data, but as long as the access control is in the hands of judges, it theoretically achieves the desired criteria.