Oooh, not quite. IANAL, but I've worked with enough to know exactly what this means.
Facebook is required to _report_ how they handle privacy data. They can choose what that handling looks like. They just have to accurately describe that. The false certification is related to materially false statements in the _reporting_. How they handle privacy data is still up to them (albeit potentially subject to future sanction if problematic), but this definitely does _not_ state that Zuck will be subject to criminal liability for future privacy problems.
Facebook is required to _report_ how they handle privacy data. They can choose what that handling looks like. They just have to accurately describe that. The false certification is related to materially false statements in the _reporting_. How they handle privacy data is still up to them (albeit potentially subject to future sanction if problematic), but this definitely does _not_ state that Zuck will be subject to criminal liability for future privacy problems.