You have to appreciate that this is a potentially multi-jurisdictional lawsuit, with the twist that both European civil law and American common law principles may be in issue, so everything is very hypothetical at this point.
However, the starting point in a complex matter: sue everyone who touched the file, or may have touched the file, to make sure you don’t miss someone or miss a limitation period. Then, as discovery goes on and the plaintiff learns more about the workings of the case, the plaintiff normally drops off people who have shown they did not have liability.
As well, executives of a corporation (ie on the board) may have personal liability for decisions of the corporation, if they agreed to the decision. In some jurisdictions, an executive can avoid that liability if they formally objected to the decision, at the time the decision was made, but not retroactively.
Also, immunity from liabilty can go out the window if the decision was criminal in nature. While a corporation normally indemnifies its executives for actions taken in good faith, intentional breaches of the criminal law normally invalidate that, and the corporation may be able to take action against its executives, if the corporation finds itself liable for the illegal acts of its executives.
So, to summarise, no clear answer, but the possiblity of civil actions is certainly there. That gets back to my previous post: given that there is the possiblity of civil actions against the executives of VW in their personal capacity, from this point forward, are they making decisions in the best interests of the corporation, which is their fiduciary duty? or in their own best interests, to reduce their own possible liability. That’s why I raise the issue of the former CEO having been in a conflict of interest once the matter became known.
(And if any executives of VW happen to be reading this post, this is not legal advice. Talk to a lawyer with experience in your jurisdiction.)