Absolutely. I think the party that needed to ID your face should take full responsibility if the data ever gets compromised. Perhaps they have a workflow where this data will be completely removed, but I somehow doubt it.
I also had the impression that they do not store some of the data verbatim but make a hopefully non-reversible fingerprint of it. But even so it's icky, and we have seen in the past that big players with all the money and IT expertise in the world got hacked and robbed. As it stands now, it's like a shootout. The party that forced me to undergo this procedure has hired the services of a third partner that I do not know and whose procedures, standards, and personnel I cannot audit. Should there arise legal issues the burden of a lawsuit or somesuch will weigh much heavier on my shoulders than on the other parties', who I assume have plenty of means to just pay for any lawyer and legal assistance they deem appropriate. Handing over very personal and valuable data in exchange for a promise, then hoping for the best and keeping fingers crossed is all of my part in this.
