The UN is under no legal obligation to report such breaches, but data protection advocates say the lack of transparency carries grave risks.