I was planning on looking into how to best document it the next time it happens, and whom exactly to report it to (i.e. the national or European data protection authority). Not sure if there is anything else I could do.