cadillac fairview was unaware the database of biometric information existed which compounded the risk of use by unauthorized parties or in the case of a data breach by malicious actors the commissioners concluded