If she ends up losing the data permanently, that will severely hamper her ability to apply for future grants (which usually require preliminary data), and lose funding. This offense is definitely self-punishing.
Why? They are, after all, her employers-- and they've got quite a bit of time and money invested in her research. I have to assume that they have some kind of standards for the care of data, and I certainly hope that keeping exactly one copy of the dataset, without backups, on a laptop which frequently travels out of the lab, is in serious contravention of a number of their policies.
You're making way too many assumptions. You can't fire someone because a laptop is stolen or lost. The University should have provided a means of centralized backup for data.
I am assuming that the University did provide a means of centralized backup, and she failed to avail herself of it. This is based on the assumption that it is more likely that one researcher screwed up, than that the entire University is woefully incompetent.
Also, note that you assumed that I meant "firing" when I said "disciplinary action." I was thinking more along the lines of a note in her file, and a stern talking-to.
