Without having read all the pages of replies since last night, Privacy Officers are pretty good at handling requests with discretion (in my experience). If they can't do that, no one can. I've both submitted requests, and been contacted regarding possible violations by others (to confirm that they had reason to be in the record). It's always been handled in a confidential matter, and leaking the information would hold serious consequences for myself. In all but one case no wrongdoing was found, and that was the end of the matter.