Government ministry says three companies’ policies to safeguard the protection of personal information are inadequate and any violations will be punished