The NHS has been criticised by the Information Commissioner over its data protection failings.