Dosas Unlimited, a public company in the ethnic foods business, requires all employees to sign a code of ethics that, inter alia, prohibits them from transmitting non-public personal information about customers to anyone outside the company, except as required by law. Jane Jones, an accountant at Dosas, violates this rule by sending an email to her roommate containing the names, Social Security numbers, and credit card numbers of several hundred Dosa employees. When Dosa discovered the data breach, it confronted Jones with its findings. Jones admitted that she had transmitted the information to a third party, but asserted that she had done so as part of a plan to retransmit the information to the Internal Revenue Service in support of a claim under the IRS’s Whistleblower Rewards Program. Jones alleged that the employees in question had fraudulently received millions of dollars in reimbursement from Dosas for personal expenditures and failed to report these amounts to the IRS as income. Can Dosas penalize Jones for violating company policy?