e.g [flagged] Target director's Global Entry was revoked after ICE used app to scan her face [>>46833871 ]
Stuff like actively expressing opposition to taking them on as a customer, trying to persuade management to do otherwise, and so on would all be perfectly kosher. But the stuff the top post in this thread alludes to, let alone what it links to, is how you end up in prison for a very long time after the 'I didn't know it was illegal' defense fails.
There has been a few news articles (and court cases) where this question has been raised and it is not strict true. Employee actions are only actions for which the employee has been given as an task as part of their employment and role. Actions outside of that is private actions. When this end up in court, the role description and employee contract becomes very important.
A clear case example is when a doctor is looking up data on a patient. Downloading patient records from people who they are not the doctor for can be criminal and not just a breech of hospital policy, especially if they sell or transfer the data.