I am currently at a loss to help you here, other than suggesting that she contact a lawyer who is familiar with internet laws and regulations and in the meantime suggest that she tone down any actions that she is pushing forward, for the sake of what he might do with her client's info.

She needs to act quickly too, as this rather unscrupulous individual could really hurt her reputation.