One thing I forgot. There's another good reason to hold CEOs and others personally responsible and punish them accordingly as it acts as a deterrent. Whenever we see Google, Facebook, etc. get levied with fines we rarely learn who the nameless gnomes are who perpetrated the act, or approved it, etc. Knowing that their names would be in the public domain would send shivers down their backs, even if acquitted it would likely not bode well for future employment.

Moreover, CEOs, directors, boards etc. should also be held accountable even when they are not directly responsible (like captains of ships are). This would have the effect of ensuring that those in charge would mandate an ethics and behavior policy for the company and ensure that all employees were aware of it, and violation thereof would result in dismissal.

Thst said, to be fair, you can't blame management for the unacceptable behavior of a wayward or stupid employee. Commonsense must prevail and laws must allow for such things.