>Deploying systems they do not properly control or understand does not shield against legal or normal responsibilities!

We can argue the "moral" aspect until we're both blue in the face, but did facebook have any legal responsibilities to ensure its systems didn't contain sensitive data?