University of Waterloo found covertly using facial recognition