The data is seemingly collected by a process called OVRServer_x64.exe—kind of uncomfortably close to "Overseer," isn't it?—which is always on, has full system permissions, and sends regular updates back to Facebook. The information collected is used to provide services, improve the product, and of course, for marketing purposes: “We use the information we collect to send you promotional messages and content and otherwise market to you on and off our Services," the policy states. "We also use this information to measure how users respond to our marketing efforts.”
In some ways it has the appearance of a non-issue—the sky is blue, the grass is green, and Facebook is watching you—but Avner Levin, the Director of the Privacy and Cyber Crime Institute at Toronto's Ryerson University, told the CBC that users should be paying attention to this kind of stuff.
“We think we understand right now what [privacy policies] mean, but their language is very flexible," he said. "There's a whole other set of categories here that all of a sudden could seem to us to be very intrusive of perhaps some of our most private moments as users of this kind of technology.” As an example, he said people might not mind Facebook tracking their movements while they're playing a game, but could feel differently about it happening while they're watching virtual porn. (Hypothetically. *cough*)
Oculus also noted that, while Facebook owns it and runs some of its services, they are not currently sharing the collected data. “We don't have advertising yet and Facebook is not using Oculus data for advertising—though these are things we may consider in the future." Which, if nothing else, is the funniest use of "may" you're likely to see on this site today.