I wonder how this will play out in court when a neural net that underpins the tech of a company also can't properly handle health data. Start over?

The right to be forgotten would have to be built into it all right from the get go, wouldn't it? Neural nets embed things, like you said. If Facebook pivoted towards being a hub for healthcare data as oracle seems want to do, could they use all of their facial recognition tech trained from profile pictures now that it is supposed to be detached from any one identity? I'm thinking of the equivalent of github's co-pilot spitting out comments alongside the code.