It is probably too hard to detect reports or plugins that expose sensitive personal data. So a sysem for manually flagging reports and plugins that do, and then have special permissions for accessing them, sounds like a good idea. 

Reports flagged as containing sensitive data could perhaps also be blocked from being made public.

Hi Magnus,
I agree with your point of view. Only person who make report can make relevant decision. Semi automatic should come out from database items like: name, surname, date of birht, sex, adress, phone, email. We can say, thats personal data, be careful.