If that's optional, it's hard for me to imagine why a company, if they have an obligation to report already, wouldn't take advantage of the ability to also report it to law enforcement, but there could be a whole slew of reasons why they might not do that.
Does your unit then look at anything that might have been reported to the Privacy Commissioner but wasn't necessarily reported to police? Now it's out there and is probably public, and the commissioner is going to report on it. What's your ability to tackle that afterwards?