Barring something within the shareholder agreement (between the startup employee and the startup) that bars the employee from selling those shares on Carta's platform, what's the issue?
You’re a startup who keeps a payroll spreadsheet in Google Sheets and the Google recruiting team accesses that data to recruit your employees and decide how much to offer them.
There’s nothing wrong with Google trying to hire your employees, but it’s wrong for them to use your confidential data from another business unit to do so.
Maybe I'm misunderstanding? But that doesn't seem like they're sharing cap table data with anyone. They've found a buyer for the employee's shares at some price. Is it implied that they shared the cap table info with that buyer (i.e. the third party investor)?
But I hope people wake up to what they are agreeing to when they sign up as a user for Carta. Carta makes you agree that they owe you NO duty of confidentiality with respect to any information you submit into the service.