Thanks both of you, that is kind of what I thought would be the answer. As the DBA I am working with our IT Security team to make sure users are clear on the implications of extracting this data and to try and make sure they enforce some kind of control themselves. I.e dont save it off the network, dont email it to personal email accounts etc. I think, as you both say, that is the only thing that can be done. Once it's out, it's out!