I think many (if not most) people are opposed to their images being used for facial recognition related purposes (training, evaluation, services, …)

I hope creative commons will create a new license like that explicitly prohibits the use of the protected works for these purposes. Of course, in this particular case a university gathered the images (violating the citation requirement) and then companies used them commercially, violating another aspect of the license. I guess UWash is at fault for not stating that Megaface cannot be used for commercial purposes?

Are the researchers at UWash personally liable? Is the university? If we get a couple of deterring judgements there's a chance this will stop future violantions.