The "reasonable" claim is made here without considering all factors. If I have the guarantee that the driver license & facial recognition data are not uploaded or kept beyond the required time frame (which should be less than a couple of hours) and are not integrated into other datasets, then this solution may be "reasonable". But that's a big assumption. Is there information on where the collected data goes and what happens with it?