Going to be interesting to see the MTTL (mean time to lawsuit) on this. Sounds grossly negligent. I feel kinda sorry for the lonely lawyer.
Most of the policing would happen by courts and bar associations.
For your situation, you really want to measure how many PII records you handle per lawsuit. That way you can accurately measure the lawsuit cost per record and compare it to revenue per record to see if you're profitable.