"Sensitive data should only be available to employees who need access to that data to do their job, and they should have the minimum level of access [needed] to use that data," said Mr Ferguson, after seeing the screenshots.