Earlier quoted context omitted.
Just how bad this is would depend on how they stored the data, I guess. Why does it feel like they probably keep WAY more data than they need instead of just the hash? Glad they’ve been shut down at least.
Molly White points out [0] that they seem to have gotten awfully vague about what they store, emphasizing in some contexts that the hashes on the chain are all that technically HAVE to be retained (and encouraging the assumption that those themselves are rigorously impossible to extrapolate personal information from)— but also insinuating to people at en-Orb-ment that they need to opt in to letting the company store…
Even the context of the primary reason they cite for collecting retinal data (to prevent the same person from getting $50 multiple times) requires they keep this data for at least as long as they're paying people to scan their eyeballs.