More should have been done to let patients know what was being done with their data, says a watchdog.