A report by Victoria's privacy watchdog has found the state failed to protect people's personal data during the COVID pandemic -- and led to a case of attempted sexual assault.