The Privacy Commissioner has been ordered by parliament to hand over a secret report detailing its investigation into American Express's technology security failures, after using gag orders and legal threats to keep it confidential.