The Dutch public prosecution doesn't prosecute when responsible disclosure guidelines were followed. For the computer fraud part obviously; card fraud would be

The Dutch public prosecution doesn't prosecute when responsible disclosure guidelines were followed. For the computer fraud part obviously; card fraud would be investigated (and there's no helping that this person will be a suspect, but without evidence or motive that should not be a big deal). That's not "this person would simply be serving time". Quite the opposite. Can't speak for other European countries, I'm not familiar with their practices, but I haven't heard in recent years that anyone got prosecuted for responsible disclosure. A few months back a company started a civil case: that was unusual enough that it made the news (and it was dropped). About a year or so ago, someone was convinced while claiming to be white hat, but they emailed the company something like "pay me and I'll tell you what the problem is. Wouldn't want reputation damage now would we?" Again, unusual enough that it makes the news, and in neither case was a legit white hat "serving time".