Because of the system’s complexity, only a ‘few state government officials understand how their state is sharing residents' data’