That is to say that, while possible, such a mapping is by no means easy or automatic, and it would have to be very calculated and deliberate and even then couldn't be 100% accurate without a whole lot of engineering. In such a case of deliberate and specific design to gather and associate MACs and identities, then yes, the law applies to such a conjunction.
You don’t have to work on a static set of MAC addresses and individuals, rather, you can dynamically track arrivals and departures from your crowd of individuals. So instead of hundreds of people being more or less stationary you get movement data on the few new members of the set and on those who left, including whereto or wherefrom they moved.
After tracking not just one crowd but five, it should be possible to map out trajectories for both faces and MAC addresses. The larger the area or surveillance per traveller and differences in e.g. movement speed, the stronger the useful correlation between these trajectories should be.
If I was really serious about it, I'd tie detection timing to the visual signals on the xray machines that tell security agents whether or not you can pass and whether to perform a secondary check.