The oversight body identified failings including the overzealous retention of social security numbers.