Re: Appropriate
There was no need to report his concerns to management
Professionalism requires that he follow the internal process first. It also requires that he not steal the client data. People like this give the industry a very bad name.
People use Twitter, Google, and Facebook to break the law every day. Would you feel it right and proper for someone in their IT department to arbitrarily decide, based upon zero legal expertise within your jursidiction, that you might be one of them, and steal all of your data and hawk it around the world?
He wasn't trying to prevent tax evasion, he was trying to profit from data theft. No better or worse than the card scammers and id fraudsters.
He needed to go right to the appropriate legal authorities.
If, after following the internal procedures, he felt the law was being broken, then yes, he should have gone to the authorities, but that does not excuse, justify, or even require that he steal the client data. The authorities can legally obtain it with a warrant.
execute people for large-scale financial crime
I hear ya... but first lets have the death penalty for murder, rape, and noncing... crimes that actually do real world harm, before we get to worrying about money. Or, you could take the civilised view that having the state murder people doesn't set the best of examples to society.