Re: Always the employee on the hook
Actually, "Uber settled with the FTC and agreed to audits of its privacy and security systems every two years for the next two decades. The company also paid $148 million penalty to settle lawsuits brought by all 50 states and the District of Columbia."
See https://thehill.com/policy/technology/512968-doj-charges-former-uber-executive-with-attempting-to-conceal-2016-hack for more details.