Any employee with an Internet connection now has the power to share confidential information—and the law is catching up