I think the cost of complying with the law is just cost of conducting a business lawfully. So, those parts should not be spoken of as if they were part of the damages.
Well obviously they should have improved their security practices years ago. Nonetheless, they incurred the costs now, as a result of self-reporting a data breach (which is mandatory). That's the number that's relevant as a deterrent for others, so I think it's fine to report it this way.