Choosing DPA to submit data breach complaint (EU-specific)

Question

Context

• The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
• The offenders asked for ransom to not publish the data, which the institution refused to pay, leading to a data breach.
• We are still waiting (roughly 30 days, now) to be informed by our law department about what exact data have been breached.
• I am working remotely for that institution, residing in EU member-state B for the last 4 years and 4 months.

My Question

I am considering to submit a complaint to the corresponding DPA about the breach and the way our institution is/has been handling the situation. Nevertheless, I am not sure to which the "corresponding DPA" in my case is.

• Should I address the DPA of my home country, B, where I stay in, my institution country's DPA, A, or probably both?
• Would it be better if, probably on top of that, I also address some EU body/institution, since more than one member-states are involved?

Answer 1

GDPR gives you a lot of flexibility here to choose either DPA. From Art 77:

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

However, the DPA from the company's country would be designated the lead supervisory authority for this investigation. If multiple DPAs are involved, they would coordinate with each other. There is no EU body that you could contact directly. But if the different DPAs have a dispute regarding this investigation, the EDPB would provide a consistency mechanism. This mechanism has been used in the past e.g. to force the Irish DPA to correctly apply the GDPR against companies from the Meta group, like WhatsApp and Instagram.

Though it might slow things down, it could be advantageous to have multiple DPAs involved, precisely so that the investigation is double-checked. If the lead supervisory authority declines the case, this would also enable the other DPA to do its own investigation.

So, it would be a good idea to lodge a complaint with the DPA of your home country, and let it forward the issue to other DPAs as needed. However, contacting the DPA in the company's country would also be fine, especially if you are fluent in the relevant official language, and/or if you live in Ireland.