The difference, as I understand it, is intent. For mishandling classified information to be criminal, there must be an intent to do so. For example, to commit espionage and provide the information to a foreign adversary.

Carelessness indicates a lack of intent. It’s the sort of thing that could get a State Department official demoted or fired, or a government employee’s security clearance revoked. But prosecution is very rare without suspicion of intent (there are one or two cases that walk the line on this, but they’re the exceptions that prove the rule). And there are no examples of high level officials facing prosecution or losing their jobs over similar behavior (e.g. Colin Powell).

Clinton was no longer a government employee, and therefore could not be fired or have clearance revoked. The government could have prosecuted her for a crime, but as Comey said, the FBI recommended against it because conviction would be very unlikely without proof of intent.