Legislatures also need to look at more data protection training for teachers, report says.