If it can be shown they did it with intent, then maybe. If they did it from incompetence or simple error then their employer should be responsible for not providing adequate training and review of work product, inadequate QA, etc.

In general I think civil penalties will be more appropriate for this sort of thing than throwing people in jail. Jail time when there was criminal intent could be reasonable, though.

No, unless its proven that they were wilfully negligent, then yes.

The argument is, according to the OP, that the entity responsible for designing/administering/maintaining software services/software/IT systems is liable. But it seems like they would like to punish the employer, and not the employees.