Criminal negligence is a thing. I would say that storing that much personal data about people, and not taking the efforts to secure it properly, should count.