Private tax debt collectors have netted more than $1 million so far, but privacy and other issues remain worrisome