Controlling access to customer data