Let me understand:  some process will be connecting to repositories, reading and exporting work item data for viewing elsewhere.  Up to the reading/exporting the JavaAPI can only do what the ID used in connecting to the repository is allowed to do.  Most likely reading work item data is allowed by project members ( and JazzAdmin ).  

However, from a data privacy aspect, once the data is exposed outside RTC it might loose the protections it had in RTC.   Once data is outside RTC the restrictions placed upon it should be decided by the "owner" of the RTC data.  This would be much like setting up Cognos with ALM but using the un-restricted DW+CALM data model instead of the restricted one:  any user that can access the external data can see any/all, rather than what their ordinary RTC access allows.