A big factor for me is the number of individuals affected, the number of individuals whose privacy is affected, so I will prioritize an investigation that will have an effect for more people than fewer people. The seriousness of the violation, of course, is an important consideration, as well as the sensitive character of the information at play.
On May 1st, 2018. See this statement in context.