Data protection watchdog says e-commerce giant failed to implement safety measures and delayed reporting breach.