The Espionage Act makes it a crime to mishandle classified documents through gross negligence (18 USC 793-f). Punishment upon conviction carries a penalty of up to 10 years in prison.
But that is not all. Comey blatantly misinterpreted another criminal statute, also under the Espionage Act, which Clinton appeared to have violated.
Under 18 USC 978, it is a crime to knowingly and willfully mishandle classified information. Yet, in his infamous news conference on July 5, 2016, Comey declared that Clinton never intended to violate laws governing the handling of classified information.
Comey was wrong. That is not the legal standard. The standard is whether Clinton committed intentional acts that violated the law. Clearly, she intended to set up a private server, and she intended to use it exclusively for all her communications as secretary of state, which would necessarily include classified documents.
The act of defying a congressional subpoena is audacious at best criminal at worst.
Destruction of records in any federal investigation constitutes obstruction of justice (18 USC 1519) and a violation of the Federal Records Act (18 USC 2071) and the Public Officers Law (18 USC 1924).