The ‘model law’ for facial recognition would assess the risk of various applications and apply controls accordingly.