> An employees actions would be a matter of judgment between the company leadership and themselves

There has been a few news articles (and court cases) where this question has been raised and it is not strict true. Employee actions are only actions for which the employee has been given as an task as part of their employment and role. Actions outside of that is private actions. When this end up in court, the role description and employee contract becomes very important.

A clear case example is when a doctor is looking up data on a patient. Downloading patient records from people who they are not the doctor for can be criminal and not just a breech of hospital policy, especially if they sell or transfer the data.

I was tempted to add this very line when I wrote my message but I hoped it would be obvious I don't mean things like illegally stealing private data. I was talking about things like "falsifying" data to the contractor, which doesn't seem like a crime to me just a contract violation.