Privacy Officer John Nocito describes his three-person team’s use of technology and disciplined processes to investigate potential cases of inappropriate access by employees