Data protection practices still poor, survey shows