However, the set of people "authorized" is not, at least not from a legal perspective. This is what the case law says. The fact that the set of people who technically _can_ access the data is different from the set of people legally authorized to access the data.

That might not be what the engineers who designed the system, run it, and produce the content intended, but that is what the law says.

It's a bummer the two disagree. But only one of the two systems put you in jail if you cross them.

You and I may wish it were otherwise, but wishing isn't going to make it so.