Then please explain my wrongness levels. Apart from data grab, what is the issue? Could company be accountable if somebody logged in with correct username and password and posted legal pictures? Because if it doesn't matter if it's bank or not, my bank clearly states that it is not accountable in such scenario.