CFAA now is about violating technical controls, not policy controls. If policy says "Don't look at HR data", but nothing technically stops you from looking, it's not a CFAA violation to look.