I guess it depends on how you define "responsibility". On the one hand, he was the CEO, so he's responsible for everything. On the other hand, it doesn't look like any of this was deliberate - more like negligent. The question is whether or not the lack of attention to privacy crosses the line into _gross_ negligence or not.