"Legally Responsible"
Which is where Cyberspace is going to get interesting, and there is no law that currently answers the problem.
Is it where the data is hosted?
Is it where the data owner is located?
Is it where the processing server is located (which may not be in the same jurisdiction as the storage)?
Is it where the company owner is located (which may be a registered company and subject to different laws for directors than from individuals)?
Is it where the domain name is registered?
Is it where the copyright content owner is located?
Is it at the choice of anyone who wants to raise the legal action in cases where there may be a choice (think patent law in the US where the case is filed in certain states which are more sympathetic than others - what would happen if the EU had a similar "federal" circuit of courts)?
Many of you will have opinions on these - please don't post replies, there is NO right answer at the moment.