The University of Cambridge has been accused of washing its hands of the conduct of a researcher at the centre of a Facebook data-harvesting scandal, in a case that raises wider questions about institutions’ responsibility for academics’ outside activities.