Someone is not responsible for causing damages can still be held liable for damages if they were negligent. One could argue that by having policies but not enforcing them, Facebook contributed to the harm befalling users, especially if an argument can be constructed that users relied on Facebook's platform policies as part of deciding whether to share data with CA.