Despite the financial penalty, the ‘big four’ firm’s breach was not found to be intentional or dishonest