That's not the point. Exfiltrating the data means it's available to non-employees (and it appears she did send it to non-employees which is by itself a clear and prosecutable violation), is not protected by the company's security and privacy policies, and would still be available to her beyond her period of employment. She's not entitled to do any of those things, especially since as you say she had access to the info as an employee anyway so she had no legitimate excuse.