If the company isn't complying with Data Protection laws and sensible security measures with access then I would feel it was my duty as a professional to contest their decisions. I wouldn't become a whistleblower but I would escalate the problem until some one listened. Security breaches hurt the reputation of a business. There will always be some one who will care about this. Maybe not always in the tech teams but at least in one of the business function teams.