The employer certainly bears some responsibility. But it also seems that Adria could have handled this better. Taking pictures of people without their consent is against the PyCon code of conduct, and it also advises against public shaming.
Apologies, I should have checked that claim rather than repeating what other people had said. The actual wording is that "Harassment includes... harassing photography or recording". That's somewhat less clear, though the warning about public shaming is still relevant.
