In extreme circumstances the individual can be sued for failure to safeguard information obtained from a client.
Anyone who is worried due to uncertainty about whether they could get into trouble is advised to seek legal advice. The most obvious way of doing this is to contact a lawyer. Alternatively (to save on money) you can research this legal area online. In the meantime such a person should write out a policy statement on their website.