Privacy advocates say student data legislation needs more work