If the article is correct then this is not using any personally identifiable information (the cameras will apparently report "40 year old man, very grumpy" instead of "onion2k"), so the GDPR legislation won't help.

If the stores tie the facial data to a credit card or store rewards card then the GDPR might stop them retaining or sharing the information.

...Where is this notion that a picture isn't personally identifiable information coming from?

I get it in the sense it's just a picture, but when you run credit cards in a store, and can temporally associate cards to faces via temporal proximity, you're just elevating the "not that personally identifiable" to "definitely so".

But they certainly are gathering personally identifiable information, namely your face. I don't know the details of the GDPR, but doesn't it cover data collection as well as use?

Yes, it covers all "processing", meaning "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".

Applying some ML algorithm to personal data certainly fits.

GDPR contains nothing that will prevent this.

It contains everything that will prevent this.

Although I believe you're likely right, this is snarky and doesn't actually present an argument. Are you expecting to educate anyone with this comment?

As an American who isn't too familiar with GDPR, I'd like to know: Why does GDPR prevent this? Can you, being charitable in your assumptions, guess why the above commenter believes GDPR does not prevent this? Why is that argument wrong?

Please show me what part of GDPR that will prevent this.

A picture of a person is personal data (Art. 4, (1)). Applying an algorithm to it in order to guess age/sex is processing it (Art. 4, (2)). Therefore, the GDPR applies and you need a lawful basis, per Article 6.

If you reply it doesn't apply because the stored information is anonymized, I quote UK's ICO:

"You should also note that when you do anonymise personal data, you are still processing the data at that point."

what does gdpr have to do with this? think cctv with added AI. all running locally.

Running locally has nothing to do with GDPR. GDPR would also be applicable if you hire persons to recognize faces and put down notes on paper.

It's all about storing or working with data about other people. No matter how it's done.

CCTV is for government consumption, no?