This should be an obvious truth. But people who install secret facial recognition in vending machines are also likely to be the type of people would exclude face images from their definition of PII.