In this case the fine has nothing to do with keeping data secured.

femboy · on Nov 17, 2022

1. Failure to define and respect a data retention period appropriate to the purpose

2. Failure to comply with the obligation to provide information

3. Failure to ensure the security of personal data

4. Failure to carry out a data protection impact assessment

While not a direct security breach investigation, these have high impact on user data. (edit: formatting)