> Personal data may only be processed for the purpose indicated at the time of collection, that is evident from the circumstances, or that is provided for by law.
> The collection of personal data and in particular the purpose of its processing must be evident to the data subject.
Note that it adds the qualifier "for the purpose indicated at the time of collection". I don't think there's a realistic argument that Facebook's UI indicates or makes evident, at time of uploading/posting a photo, that the photo can be used by third parties performing facial recognition.
And then, even if you give Facebook consent to do certain things, that consent does not extend to third parties scraping it.
I suppose they could use facial recogniton to prevent those uploads...
(PDF link) https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...
Speculation but I think it can be as simple as Art. 4, p. 3 FADP [0]: "Personal data may only be processed for the purpose indicated at the time of collection, that is evident from the circumstances, or that is provided for by law."
When users upload data to Facebook, they don't consent to have that data used by third parties for facial recognition.
[0]: https://www.admin.ch/opc/en/classified-compilation/19920153/...