Germany has set up a facial recognition surveillance system with the privacy protection that all such systems should be required to have: face images that don't match anyone in the search target database are immediately deleted.

To make an ethical system, we need a couple of additional points. A court order should be required to put someone's face in the database, and people should be informed when they are in the database so they can challenge the order.