If Data.pm is your file, I'd clarify first if $data is really not initialized.

NB: it's possible (and easily implemented) that a module delegates the warning line and file to the caller, probably that's what XML::Simple is doing. *

update

*) At least it's using Carp

˛) from warnings : This means that the scope of the warning pragma is limited to the enclosing block. It also means that the pragma setting will not leak across files (via use, require or do). This allows authors to independently define the degree of warning checks that will be applied to their module. (emphasis added)