Some people need to be able to do that as part of their job. Either directly for some good reason, or indirectly (they are a DB admin). The question is what controls they have to ensure only those people can look such things up and that they don't abuse those rights.