Over the course of my two years with my current employer, I've collected a small but not insignificant amount of company data on my personal machine(s). Most of these are in the form of old config files I keep as a back up or emails with information I like to reference. SOME files contain more potentially dangerous information from user ids to private VPN configurations. I know that most of this information resides elsewhere, I keep it there now for easy access.
I'm leaving in roughly a month (my boss already knows), what I suspect he doesn't know, or chooses to ignore, is that some of the things both he and a client told me to do are, while not illegal, wrong. By this I mean that there has been a continuous pattern of choosing speed or cost over system reliability, security, etc. I anticipate a lawsuit one day, and being the only person in the company who actually dealt with these things, I don't see how I could not be at least contacted by either party.
My question: I've been obsessive about documenting everything: who wanted what done when, why, what phase the moon was in, and the color of my underwear. The documentation will live on without me, but I have a personal paper trail of config file snippets, emails, and other records. I'd like to hold onto this personal documentation. Do I open myself up to any ethical or legal implications in doing so? The information is certainly confidential, but doesn't contain things like passwords or user logs.