The commission's annual report says financial incentives for people to take privacy seriously are lacking.