Its simple:
People who had access to the account and didnt act - are responsible.
People who had authority to tell the 1st people to act - are responsible.
The problem with AAWA which still exists is that people don't know who has control of and access to personal information collected and there seem to be no controls over how that information is used or who it's shared with or even why they need it in the first place. Why are they collecting so much? All it does it put people at risk.
It's just been lies all along and some of the people have already shown they are willing to be underhand and vindictive when it suits them.