Notifying users about a breach is a security practice, so they are being fined specifically because of their own security practices.