A careless programmer making a bad choice should simply not be able to leak 200M personal details.

I am not sure that jail time is really the thing here, but there are institutional problems if this is something that happens.