Not legal advice, obviously, but this sounds more like a public relations fiasco than a liability situation. Liability laws differ from state to state, but generally you have to prove there was actual damage in order to win a suit -- in other words, the information was actually used in a way that did you harm or at least the loss of that information caused you to have to take extraordinary measures to protect yourself, say from identity theft. The information you would typically gather as a PTO generally can be found in other ways -- contact information, kids' names and grade, etc. So it would be hard for someone to demonstrate that the PTO's negligence caused them real harm.
If you're concerned about liability, you might consult a lawyer for tips on how to handle the situation. Again, this isn't legal advice, but I would think that being upfront about what happened -- notifying parents immediately so they can take action to protect themselves if they're concerned -- would be important if there were liability involved. You should also have a plan in place to demonstrate that it won't happen again. For example, maybe those forms should never leave the school. If they're to be entered into a database, it can be done on site.
We send out a volunteer form at the end of each year with parents & kids' names & grade levels, addresses, phone nmbers and email addresses. We ask for them to verify the information for the directory & what committees they want to volunteer for. The person who had the forms lost the bundle. There is alot of personal information on those forms which I am sure that parents would be upset to know that it is floating around somewhere. Is the PTO liable for anything? Can a parent sure the PTO for loss of privacy or something? Not sure where we stand on this.
