Who can access the data on my ESTA application?

Generally, your application and information are only accessed by government officials on a ‘need to know’ basis as far as possible.
The information on your ESTA application is stored by the Department of Homeland Security (DHS) and they control the database with any information collected by applications. They in turn can share it with consular officers at the Department of State (DoS) to determine whether the ESTA approval should be issued to an applicant (you, or possibly someone else if your application is relevant). In fact, the DHS and DoS currently have an agreement to share information pertaining to ESTA applicants for the purposes of decision-making.
Additionally, information can be shared with other departments - but this can only occur for a valid, necessary reason, and is more restricted. In fact, information related to ESTA application can be shared with the appropriate federal, state, local, tribal and foreign governmental agencies or multilateral governmental organizations; though the information can only be shared outside of DHS and DoS solely if this information is needed for civil or criminal investigation.
Also, information is shared with other facets of the government for counter terrorism and also to stop international crime, which is why the data collected from ESTA applications can be shared with multilateral organisation, compared against multiple databases, and analysed. Airlines and cruise ships will not have much information related to ESTA applications aside from receiving an update on whether they have been approved or denied. Just to be sure, however, we recommend printing your ESTA form after it is accepted and before you board the aeroplane or ship just in case, because if the travel service has not been notified and if you cannot prove you have an ESTA, you will not be able to board a plane or boat to the U.S.