Some employees are taking advantage of access policy gaps without realizing they are breaking privacy laws.