I refuse to believe that a vending machine using facial recognition without the knowledge of customers can be GDPR compliant.
How can individuals give their consent?
How can they know what their data is being used for?
How could they possibly request their data be removed?