The punishment does not even remotely fit the crime. Here are some crimes that have lesser maximum sentences:
Female circumcision - 5 years
Racially-aggravated assault - 7 years
Abandonment of children under two - 5 years
Dealing in firearms - 5 years
Failure to disclose information about terrorism - 5 years
Administering drugs to obtain intercourse - 2 years
Incest by man with a girl under 13 - 7 years
Sexual penetration of a corpse - 2 years
I could go on.
So what punishment does fit? It is one thing to say it is stupid but another to come up with a solution. Especially as the intent of this it being made consistent with an existing, physical version of the crime. Or do you think that one is also too much.
You have not convinced me that seriously harming the revenues and careers of entire companies because you decided to leak something that you don't own
(which if anyone fucking read the OP is what this law is aimed at) should get less than 10 years in the most harmful case (and you might be aware maximum sentences are rarely given out let alone served, that would be an interesting feedom of info request crimes, max time, time given and time actually served...).
It seems we really have a generation who has grown up thinking intellectual property is worthless. The law is trying to play catch up to this changing world and maybe being a bit heavy handed in places while negligent in others.