> "do you know how many people we'd have to fire if we went looking for abuse?"
I think they make the mistake of presuming this has to go up to 11 on day 1.
Tell the employees you're going to be proactively auditing. Choose a threshold. Interview and potentially fire those employees going over the threshold. Do this until you're done firing people, then increase the threshold and repeat. You will have to fire people, or threaten to, but employees will get the message that the PII-party is over.
The challenge was that depending on the role, the union was involved. When that came into the picture there was a long, dragged out grievance process where someone would have to violate the policy x amount of times in y months before they'd be terminated. It was not unusual from what I've seen for folks to abuse this for years.
To be honest tho - this is the contract that both the company and union agreed to, so bad on the company for being okay and not making this a more serious infraction. I've talked to some of the union stewards about this and they basically said they wanted this data locked down harder. They said it's too easy to access and super temping and wished the company would put more protection around it. Go figure.
I think they make the mistake of presuming this has to go up to 11 on day 1.
Tell the employees you're going to be proactively auditing. Choose a threshold. Interview and potentially fire those employees going over the threshold. Do this until you're done firing people, then increase the threshold and repeat. You will have to fire people, or threaten to, but employees will get the message that the PII-party is over.