Despite criticism that the report left critical data out of its analysis, its author maintains states have inadequate student data privacy policies.