I am a very junior researcher working at a government research institution that, alongside R&D, hosts lots of educational courses. Due to presence of potentially sensitive data, biometric and other security restrictions are present; most of which are handled by inhouse IT. Recently, there have reliability issues with our security solutions, and until new tenders and contracts were laid out, we were asked to brainstorm some intermediate (preferably cheap) measures. Also of note, the entire campus is under (usually multiple) camera surveillance at all times.
During discussion, me and a colleague had brought up small-scale facial recognition technology (FRT) as a long term prospect. We were asked if there were open source solution and I suggested OpenFace (by Carnegie Mellon University). Management was very interested and asked IT to deploy it in campus as a separate project and to use it as a way for tracking everyone on campus at all times. I had registered my protest at this being a possible privacy violation at the time, but nobody else seemed concerned.
Later, my colleague was separately informed that she and I were strictly not to inform anyone on campus. She was also told look over the implementation and give recs if necessary.
The problem is, I think FRT can be irresponsible and can be a violation of privacy unless handled very carefully. Even OpenFace's readme makes this very point. None here shares my POV, and I'm kind of at a loss as to what to think. I can bring it up to higher authorities, but I'm very, very junior and don't want to make a mess about something trivial. My initial suggestion had been purely to implement FRT while entering highly sensitive rooms like server racks/satellite control centers/etc.
So, is it ethical to implement such wide-spread face recognition, possibly violating privacy, without informing users? If not, what can I do about it?
Also, I'm in India, if that helps. And I know that there are no strictly legal objections.