But experts say firms need to pay attention to what they do with the data after they have reported it