Furthermore, there was a falsehood of security to begin with. You shouldn't legally be able to say the data is safe when it isn't safe to anyone with a couple photographs.