I am not a lawyer myself but can't one argue that this company has duty to ensure that data it is processing for client is legally obtained.

If they are processing data after being told it was not obtained with consent do they not have any liability?