If an employee did have a business (or their spouse) and a loan was booked by the bank, a code of 1 or 2 is not a violation of their privacy in any fashion and as such we use the appropriate code to coincide with the business revenues. Revenues do not mean income, and if you have an employee running a multimillion dollar business I guarantee the folks at the bank already know this, a code 2 won't make a difference.
A bank can have code 3's but MUST be able to support why, expecially when they have several. But, there are reasons for having code 3's, for instance, in the case of a scoring system on small business loans that isn't using income as a calculation. In this case, numerous 3's on small loans within the perameters of the program would make sense. Additionally a program to new practictioners coming out of med school, where future earnings potential leads to the credit decision verses revenues would be another reason to have 3's.
In either case, remember that 3's mean no revenues were used in the credit decision. A bank with too many of these probably needs to think about safety and soundness more than they do a file scrub