One useful test of the need to involve an IRB is to ask this question: would the experiment be useful if the data were generated by a random process and not by a human? For scenarios #2 and #3 above, the answer would clearly be ``no.'' The only reason that our hypothetical Bob is interested in reviewing password rule violations, and Christine is interested in search terms is precisely because this information is being generated by human subjects. If the passwords and search terms were randomly chosen, the research would not be worth doing.
If the experiment can be performed with randomly generated data, then use random data. This is an application of the ``respect for persons''[#!belmont-report!#] ethical principle.