Theft of personal information seems the most obvious one that they could be charged with. Unauthorized access of email accounts and exfiltration of information is something hackers have gone to jail for.

The Computer Fraud and Abuse Act (CFAA) prohibits accessing a computer without authorization, or in excess of authorization.

Facebook have broken a huge list of laws. But recently from my reading I think the current issue is a breach of contract. They signed a legal contract with the FTC and then broke it, hence the fine.

There doesn't seem to be any debate that Facebook broke the law - just debate about what the punishments should be.