I made some photo sharing PoCs about 10 years ago. Step 1 was strip exif data at the earliest possible point. It isn't just the CEO, there were any number of people that could have applied the basic level of diligence to this problem.

Clowns.