Of course. In this type of case, the responsibility falls on your shoulders. If your son were engaged in this type of thing, there could be some complaints. We would have to initiate an investigation, and you would have to describe the situation. We would explain how the law works in these matters, and we would tell you to monitor your son. However, if the problem occurred again, we would have to take requisite action.
But it looks here as though we are talking about an unplanned act, an accident. In such a situation, your son would not have been aware of the provisions of the law. You would simply have to establish a system in order to protect your data.