He should be held personally liable
Generally, if there is no harm, then there is no liability.
In this case, there may be a case for defamation, but if the company only reported that the police were looking for a particular suspect, which was true, then maybe not.