'Biggest ever' deletion of biometric data by government comes after HMRC obtained data "unlawfully" according to privacy regulator.