I think that it became their data as soon as you uploaded it to Facebook. That's probably what the terms of service says, not that I've read it. Ultimately the lawyers decide whose is what.
I'm sure they'll claim that the friend has the rights to the image and the friend gave permission via a click-wrap contract of adhesion.