You only have legal protection if you DON'T know what your customers have stored and if it's removed when found.
Jack knew what they had access too and didn't remove it, but instead authorized employees to inappropriately access and use the private pics.