‘It’s actually a fairly common problem’: privacy lawyer explains when ‘just looking’ at records becomes legal, reputational minefield for employers