Earlier this week, U.S. Customs and Border Protection (CBP) confirmed to media outlets that surveillance images of travelers taken at an undisclosed land port had been compromised as part of a cyber attack on one of the agency's subcontractors.

According to The Washington Post, those images included the faces and license plates of people crossing the border and are used as part of an ongoing facial-recognition program that tracks people going into or out of the U.S.

While it seems unlikely that the government would ever curtail its ability to collect information pertinent to national security in the advent of a national privacy law, incidents like the one with the CBP could play a significant role in determining where and how long that data can be stored.

“We need a change in thinking that moves more towards data minimization than data protection, because data protection is an illusory concept,” said Robert Cattanach, a partner at Dorsey & Whitney.

Data minimization isn't a totally foreign concept to the annals of the privacy debate. It's a core tenant of the European Union's General Data Protection Regulation (GDPR), which requires businesses to limit their data collection and storage to information that is relevant, adequate and integral to “carrying out the purpose for which the data is processed.”

Governments present an entirely different challenge on that front in large part due to the ongoing tension between personal privacy and the security of the public at large. Cattanach ventured that government officials may feel less burdened by what happens if license plate or facial recognition data they've collected is breached than the possibility that a terroristic threat goes undetected.

“On biometric data in particular, I don't think it's realistic in this day and age to say you can't collect it. But it is realistic to say you can't keep it for any longer than absolutely necessary,” Cattanach said.

A running clock may not be the only impediment law enforcement faces with regards to collecting or leveraging biometric data. Myriah Jaworski, a certified information privacy professional with Beckage, pointed to some potential constitutional issues that could be triggered as well, such as illegal search and seizure. However, she doesn't think that law enforcement agencies will ever find themselves placed under exceedingly rigid controls since national security prerogatives are often respected by the courts.

“I do believe that in the future that law enforcement's use of biometrics will be treated differently from the collection and use of biometrics by private companies. … I think that it will be entitled to some constitutional protections,” Jaworski said.

That's different than being totally off the hook, though. Incidents like the CBP subcontractor hack could place increased scrutiny on the client and vendor relationship and the obligations that organizations face in accounting for the security practices of their service providers.

A statement sent by CBP to journalists said that the unidentified subcontractor violated mandatory security and privacy protocols outlined in their contract. With the GDPR, the EU has already taken the kinds of technical and administrative controls that vendors are required to maintain a step beyond contracts and into law.

“There's that whole controller/processor paradigm in the GDPR that I think we might see utilized by states here or potentially by the federal government here in future legislation,” Jaworski said.

So what might some of those requirements look like stateside? Cattanach argued that organizations should be performing regular audits of their vendors and subcontractors to ensure that they are following the proper handling and security procedures.

“Right now there's no mechanism, generally speaking, to enforce that kind of regard. So we've got a long way to go,” Cattanach said.