For auditability, Koha should log when patron data and/or PII (name, email, address, etc.) is exported using a report. At the least, the log should include the type of data exported, time of export, and the staff member who did the export. This could be expanded for more detail, this is just a starting point suggestion!