software privacy confidentiality
Access to sensitive information of employees as a fellow employee
<p>I'm a programmer who works closely with an engineering firm to create tools for the automation of business processes.</p>

<p>One of which I'm working on currently requires that have the access (although I will actively avoid accessing,) of some of my fellow co-workers sensitive data, like billable hours, billable rate, among other information, through an API.</p>

<p>I want to make sure that I take proper measures to ensure that I am in good legal standing before obtaining access to such information. What measures should I take to make sure that I have legal access to such data?</p>

<p>I respect that you want to keep the information private and secure, but as the comment said, really all you have to do is not abuse it. </p>

<p>While writing the program, only look at the personal information that you have to and don't tell anyone what you saw.</p>

<p>It's simple, honestly.</p>

<p>If you have a legitimate need for access to the API and its underlying data, and have been duly authorized by the appropriate person, and do not abuse the access by examining data beyond your legitimate need, keeping copies of the data, bypassing or compromising security in any way, or sharing with anyone else any information you learn through your access, you should be OK. Your employer or client may want you to sign a confidentially agreement or an NDA, promising that you will follow proper procedures and not improperly disclose info. You should sign if asked to.</p>

<p>Often it is possible to create a test database with "John Doe", "Jane Roe" and similar fake names and corresponding fake data for use in development and testing. This is a good practice, but is not always feasible. </p>
