Because I manage our network, user accounts, computers, emails, CRM system and am responsible for making sure all that data is secure. He says it is ok because he doesn't realize what it means to allow them to have access to it. I asked because I didn't know the legalities of customer data being collected and what might legally be defined as "shared" in this situation.
A person that is not officially employed by the company having access to our customer information (even if it is just address info and correspondence), is not a good business practice. It may not be illegal, but from a security standpoint, it is not right. How would you like it if you bought a car from Ford and the spouse of a salesmen who had access to the entire customer database was looking at it, contacting customers and has the ability to take those contacts and say, download them into a .csv which could be given to anyone?

