Police are using live facial recognition to scan millions of faces. A law governing its use is on the way, but campaigners warn it won't be enough.