Still making this a "CISOs are in danger!" issue
Sullivan belongs in jail. He's brought the CISO's role into disrepute, he still fails to accept any responsibility, and news sites and conferences still give the grifter stage time and column inches.
He wasn't charged because of the breach - he was charged becaused he colluded with the CEO and head of legal to *lie to the regulator* about the breach.
At a time when the regulator was already investigating Uber's dodgy exec team. As an ex-prosecutor, he was completely aware that he was choosing to break the law.
And he decided that his Uber stock options were worth more than the chance of getting found out, and now he continues his "woe is me" world tour.