[remus]

The law varies a lot around the world, but in the UK at least you need a lawful basis for collecting, storing and processing information like that (in the GDPR lingo, special category data). Unless you had very explicit permission from the individual I think you'd be hard pressed to demonstrate you had a lawful basis for collecting the information, as it would almost certainly not have been purposefully made available.