You can recognize me all you want as long as you get rid of the data and metadata when the my interaction with your system is over.
Edit: I'm not saying it's even possible to have facial recognition be useful without lots of data retention, just that retention and potential for bad things as a result of these sorts of data sets existing is the problem, not the act of recognition itself.
If nothing else I'd like it to be able to remember the faces of people I personally meet (so I don't need to share their data but I do need it saved in my device). I don't see how that would be compatible with data privacy laws regarding facial recognition though.
As an example, I toss around with the idea of "localized recognition" a la I upload a contact and his/her photo, and therefore my AR tool can recognize the contact image using ML, but it's not uploaded to any central server in any meaningful way (outside of maybe certain metadata to update the underlying ML models.) But even then, some might find that creepy...
Wouldn't the analogy be like Facebook identifying your face in photos, but not retaining the fact that you're in the photo?
Otherwise, you run the risk of not updating the model to fix the false positive, and you might be flagged multiple times in the future.
What value does a recognition have? Is it just metadata they can act on in the moment? AKA age, height, race, gender? Are you ok with them knowing it is you by name or a assigning some UID to you as a person and keeping metadata? What about a hash of your facial pattern? How do they know if they've seen you before?
To a lot of FR programs they want to be able to analyze their customer breakdown. They want to know more than just crowd information. Given that we regulate the storage of medical information so highly right now, and you can infer based on purchase practices whether an individual has certain medical issues, I can see regulation being needed. But it raises a lot of questions about how to realistically regulate a system like this.
I'm by no means saying "don't regulate." but we need to be thoughtful about how we proceed so that regulations have few loopholes and protect citizens from both corporations leaking data and the government tracking individuals needlessly.
In Ireland the government is obsessed with issuing everyone with a "voluntary" Public Services Card, the photo on it being biometric. Officially it is voluntary, but you need one to get many public services, including getting a driving licence or passport - so not really voluntary.
The system has been used to catch a handful of benefits cheats - single numbers - so naturally the government hails it as a major fraud fighting tool.
Now catching benefit fraud is worthy, but where do you stop? You may think the GDPR protects the system from abuse, but that counts for nothing where the authorities pull the crime prevention and detection card. The protections provided by the GDPR can be cancelled out by a court order if Gardai claims it will solve/prevent a crime.
And once that has happened a few times it will start to become normalised and eventually abused. E.G. Applying for a civil service job and being turned down for going on an anti-government rally ten years ago.
If you create something that can be abused, it probably will be abused.