I personally think the board and CEO should be personally criminally liable. I don't know exactly how but if I can't use ignorance of the law as a defense for shouting in public (one yell back at someone who yelled "fuck you" at me and I got a $180 fine) then the CEO and board can't use that as a defense for leaking data for SIXTEEN years.
Didn't know this was happening in your organization? Fuxk you, go to prison.
Anyone conceivably responsible for ignoring the developer's complaint should be on trial right now.