Initiative involving Americans’ personal data on systems run by private firms has ‘enormous concerns’, say experts