Criminalizing bugs would be insane, and would drive up the cost to create software, and probably also drive down the quality (due to pushing us into a smaller ecosystem of proprietary code). It would definitely kill open-source, because who would be stupid enough to release a source-tree that could send them to jail.

That said, statutory civil penalties (fines per occurrence) for the effects of the bug in production _would_ fix the problem. Who is going to keep giant data-lakes around when they are the business equivalent of toxic waste? The developers are still able to write code, but they are incentivized to not collect extraneous user data.