If he's smart, he wouldn't even consider leaking any data he may have access too.

Right.

Because an individual defending himself against civil AND criminal proceedings will get very expensive very fast. In addition, any competitor would be very cautious about touching that data if the guy approaches them trying to sell it, because see figure (1).

So the only avenue remaining is selling the PII to spammers and identity thieves, which will still land him at figure (1) if they get caught and roll over.

#3 should cover this.

3) Make him and every employee sign-off on the P&P Handbook, in which there's a clear clause that in case any personally identifiable data is on his/her machine, he/she is fully liable for the implications of that data getting leaked. Any such employee will be complicit in any criminal proceedings.

"All production data" means all production data. Making that clear is part of this process.

Making it clear and making it happen are two very different things.

The principle of charity is having a bad time in this thread. brijeshp did not type "all" and secretly mean "all but the backups". I did not say "make it clear for abstract reasons, but don't bother making it concretely happen because that's not necessary". These "corrections" are not adding to the conversation.

On re-reading, I see your point. My apologies.