Sure, and that is definitely a separate issue that should be addressed. The point of contention is that with data leaks of SSN-esque data, we have the theoreti

Sure, and that is definitely a separate issue that should be addressed. The point of contention is that with data leaks of SSN-esque data, we have the theoretical ability to hold an entity accountable for that violation of privacy and trust. If you're scanning my face with a discreet, pinhole security camera and then sell the data you gather to a 3rd party who then loses that data in a leak, what theoretical recourse do I have when I didn't even know the data had been gathered & subsequently lost in the first place? Edit: removed some text that was poorly thought out and not representative of the point I'm trying to make.