To me, the real question is whether a company can be careless with our private data and just walk away. If a breach happens because they ignored obvious security, that's negligence that hurts people, so criminal charges seem fair. I'm not sure how to argue it better, but that's my gut.