I'm not familiar with Canadian law, but in the States, I can film someone without their permission in public. I can't do certain things with that recording, but I can record them. In this case, I see it as just that. Recording, doing some instant analysis, recording non identifying metadata, and forgetting the recording.
That would make it gdpr compliant, at least.
I mean, I don't disagree. I'd rather that too! But you're arguing if it's good policy to do this or not, that's a different argument vs. whether they legally and ethically can.