In wake of Banjo controversy, auditor warns against expansive state deals with firms collecting personal data