Kmart broke privacy laws by scanning customers’ faces. What did it do wrong, and why?