It's a question of negligence. My understanding of the fact pattern is:
- a piece of property was lost at a place of business
- an employee or employees of said business found said piece of property
- the employee(s) (and presumably the manager, although that's unclear from the facts as presented) promised to secure the piece of property until the owner retrieved it
- there is nothing in the fact pattern indicating that the retrieval of the property was delayed in any unreasonable manner
- there is nothing in the fact pattern indicating that it was necessary to use the property in order to either protect life and limb or protect the property (e. g. it was not a dangerous piece of equipment that needed to somehow be used in order to diminish danger to persons, nor did it need to be used in order to protect it. Think of having to plug in a refrigerator if there was something in it -- also belonging to the property owner -- requiring preservation, or perhaps a hand grenade that a person would have to hold the pin down on or a gun where a person might need to unload it or put on the safety in order to protect people around it)
- an employee or employees used the piece of equipment with neither the owner's knowledge nor consent
- the owner's consent would not have been forthcoming. The owner did not permit the employee(s) to use the piece of property and it is not reasonable to assume that the owner would have granted said permission.
- the use of the piece of property resulted in emotional distress and possible loss or diminishment of the property owner's reputation.
- these losses are considered to be measurable damages
- it is unclear whether the employee(s) were acting under the direction of anyone in management at the company
- the location is a franchise which may or may not be under the governance of corporate headquarters with regard to the personal conduct of the employees.
Anyway -- by looking at it that way and removing any talk of nude pics and cel phones -- the bottom line is that an assurance was made that the phone would be secured, it wasn't, and as a result there was embarrassment and distress which are indeed actionable. The only real question is whether the franchise location's employees' personal conduct can be pinned on corporate HQ. Make no mistake about it, Mickey D's will fight this and will try to pin it on the franchisor him/herself. And this lawsuit, if the plaintiff's attorney is at all competent, is against both corporate HQ and the franchisor. Liability is more or less a given (there's negligence, there's reliance and there are measurable damages, although they may be kinda small); it's up to the defendants to duke it out on who's responsible for the employee(s).
My money is on the franchisor being put on the hook for this, as we are not talking about major things like civil rights violations or insider trading. Corporate HQ is in this lawsuit because they have deep pockets, and the plaintiff is hoping for some cash from them as well as the franchisor, but dollars to McNuggets, the lion's share of the liability will rest at the feet of the franchisor.