How to avoid risks without affecting employee privacy