Normally, he would be immune to a personal lawsuit, but he sought these records, when he was not authorized to do so. He subpoenaed these phone records on 10/30 and he was not authorized for his investigation to get these phone records until the following day on 10/31. It is not a trivial thing to have missed this authorization, and In addition to personal civil liability he is also criminally liable under a variety of federal laws and could end up in the federal pen for 10 - 20 years.
If that’s the case, then put him in jail. Throw away the key. Lawmakers should face a much higher standard.