Retaining him - rewarding him, even - in contravention of company policy seems to create a great deal of liability for the firm if there is any PII leakage. &quot;My client&#x27;s personal data was stolen from your firm, and we found that you have this employee, who had the client database on his home laptop, but you didn&#x27;t fire him? Here&#x27;s a lawsuit.&quot;