Audit critical of state's handling of private data