If he violated company policy by moving PII to his laptop, then the company may punish and/or prosecute him. But if there was no consistent policy then one must

If he violated company policy by moving PII to his laptop, then the company may punish and/or prosecute him. But if there was no consistent policy then one must be formulated and all employees brought to heel without recriminations. If he demonstrably violated company policy then the company nonetheless may be responsible for his past and continuing actions. In this case I would also hire a knowledgeable private investigator to help determine what he might have done with the information. If you are responsible for allowing the situation, or in allowing it to continue, then you may, in the end, be terminated or required to resign. Prepare yourself. Perhaps you should consult an attorney.