Agencies' efforts to protect personal information vary widely