The law lags behind technology, but a patchwork of rules applies:
Keeps facial recognition data off third-party cloud servers.
