Records keeping procedures of sensitive information is a valid area of concern for businesses like JTX. It looks like the company is already doing their own investigation into what Mr Burnett did and of course they take this sort of incident very seriously. Read the very bottom. http://www.news4jax.com/topstories/25442389/detail.html The STORY is about the MAN that made a bonehead decision. Did JTX tell him to dispose of the records in that way?? Nope.
Regardless this was a localized incident involving a FORMER franchisee who made a VERY POOR personal decision. Any scenario can be "what if"fed into some big massive liability. What if this massive scenario you described then spread to all of the companies in the United States who collect and store private information about their customers. Would JTX be held liable for starting all of this massive investigation? ummm..no.
On the legal aspect, if a former employee or customer wants to sue over this then I would tell them to get in line with all the other folks. JTX keeps plenty of lawyers on retainers as does most big companies who get sued for any and everything that our litigious society can dream up. And if in the off chance the person does win...that is why JTX and their franchisees have insurance of all sorts and types. Unfortunately, lawsuits happen and will happen all the time with service businesses like JTX.