Bruce is missing the point too. He does see that the problem with facial recognition is the backend database with data about individuals. The way to index this database is not the problem, and that's where facial recognition comes in.

Facial recognition used exclusively to access my hotel room? Fine! Even fingerprint. No problem. As long at that data is not linked to other databases, and is erased, at minimum when I request it. And, most importantly it needs to be protected against cross-referencing to government databases.

Because that's where the real problem lies. Cross-referencing. Is a store allowed to remember data about me? Sure. That's what store clerks do. The employees at the post office don't ask for my name anymore, they use facial recognition (the wetware kind) and then go look for the packages with my name on it. Great!

I go to a psychiatrist and he proposes that if he diagnoses me with something I can get all the visits paid back. Ok, whatcha got? Well, autism seems somewhat justifiable and is very popular at the moment. Okay. Now this data gets passed to the government in my medical file, cross-referenced to my insurance, passed to them, and now I can't renew my car insurance. There's special cover for that, more expensive, of course. Even worse: it got cross-referenced in the government itself to, and I now have to get approval from a psychiatrist to get my driver's licence renewed, every time.

Okay, so I contact the psychiatrist, and this cannot be removed from my medical file ("because then I could sue medical professionals and they wouldn't be able to defend themselves using the data they have"). Okay, fine, YOU can keep your notes on me if you must, but I want it out of my government medical file. Nope, that system just doesn't support that. We can add some additional explanation if you want, but that's all.

So I feel like the needed laws are:
1) Any medical data is off-limits for cross-referencing of any kind with no exceptions. It is also off-limits for government and cannot be used for traffic, tax, ... purposes. Even law enforcement should not be able to see this data under any circumstances. If such data is needed or important in a case, a judge can call my doctor to testify, to answer specific questions, and that's the absolute limit of government access.
2) Any data you record on me you need to specify what it will be cross-referenced with, for companies, but ESPECIALLY if you are the government. There must not be any consequences for saying "no". And when asking permissions, only explicitly enumerated named companies/departments and databases with clear listing of what that data is used for and nothing outside of that.
3) I want the ability to withdraw that permission at any time, which means ANY system that it was cross-referenced in must delete that reference
4) I want the ability to delete any data about me that was passed on AFTER THE FACT, ESPECIALLY in government databases, even if I initially didn't tell them not to pass it on.
5) I want something like Google's privacy dashboard, but for the entire government. Ideally also including companies' data. Which has buttons to delete this data that actually work.

If you follow these rules, feel free to use facial recognition, fingerprints, heartbeats, ... to index the data you do have on me. Not a problem. I can always demand you delete your data and start from scratch though.