Tax staff prevented from transferring taxpayer data except when 'absolutely unavoidable' in security crackdown