Properly private .. or recoverable via an FOI after the appropriate lapse of time?
Even if not entered into a formal record, properly private, or logged by higher command and saved for X days in case of need for review.
I can believe it's secure from outside hacking, I question whether it's private w/out some form of logging baked in.