Interesting, no personal data (once verified) needs to be kept if done right. As long as the face matches and the person is 'of age', what are other details needed for? Maybe if someone needs blacklisting then you might need some airgapped data but this could be matched to a hash or something?