To me, the interesting thing about this is that the "biometric data" is actually the collection of photos that the users uploaded.
The data-structures used for facial recognition are just metadata, extracted from the original imagery. It seems to me like data retention laws would apply to the original imagery, but not the derivative data structures. But that's obviously not what privacy-conscious user would expect...
I'm interested in seeing how this kind of case ends up being decided, when it (inevitably) ends up at the supreme court.
> It seems to me like data retention laws would apply to the original imagery, but not the derivative data structures.
That's probably not how it works.
If I have a database of personal information of users, and I throw away the user's day of birth (but not birth year), I have still a database with sensitive information.
Also, if I convert a CD to MP3 format, then I'll also throw away 90% of the original information. I might still be liable for illegally copying a song.
The data-structures used for facial recognition are just metadata, extracted from the original imagery. It seems to me like data retention laws would apply to the original imagery, but not the derivative data structures. But that's obviously not what privacy-conscious user would expect...
I'm interested in seeing how this kind of case ends up being decided, when it (inevitably) ends up at the supreme court.