Agencies Not Protecting Privacy Rights, GAO Says