Critics say if the US can’t protect such data – which was improperly stored by a subcontractor – it shouldn’t collect it.