All of the above, preferably. Government agencies for law enforcement may be exempt anyway. Perhaps the only decent use is a biometric ID or passport and should be regulated as identification data on those documents, that is rigorously.