[apalmblad]

First of all, I'd suggest addressing the issue company wide. Before firing, tell everyone pii outside of the office is unacceptable. Figure out a way you want to deal with that that lets people keep working, whatever it's work through a VPN, anonimizing data, or what not. Address it as the privacy issues it is, and ask all developers to acknowledge and agree to the policy change. It might smell funny to some, but it's not an unreasonable policy.

After that, offer increased severance as other posters have suggested.