I went to a gas station that had facial recognition cameras. They cited theft, but also their "legitimate interest", using website cookie language - only there was no easily apparent way to object to their legitimate interest.

What we really need is legislation. The law needs to recognise that businesses cannot just steal data from people for free for their own profits - not to mention exploiting that data against the data subject.

If you build and sell a car, you have to pay for the nuts and bolts. You can't just take them and say "well, you wouldn't know how to build a car, and they only cost a tiny, tiny amount, so we don't need to pay you."

Personal data has value. So much value, the businesses that focus on collecting it are some of the wealthiest in the world. We are all being robbed.