Also technology provider is important. I doubt that government is able to self host face recognition. So the most common implementation would be microsoft (or any big corp good at lobbying in this part of the world) owning technology and data to preserve their vendor lock in. So there is high probability that those data will be used for other purposes (you can easily imagine standard corporate excuses if someone finds out).