role probably has "restrict employee fields" box checked