Facebook boss Mark Zuckerberg has said the social network "didn't do enough" to protect user data in a statement to the US Congress.