If this 'sysadmin guy' doesn't have root permission but is responsible for web data why isn't he part of group www-data?
Just wondering...