Sadly, this is a horrible example of what can happen as a result of implementing privacy-invasive facial recognition systems... When privacy advocates warn of the risks associated with surveillance-based systems like this, data breaches are one of them.
According to the Have I Been Outaboxed website, the data includes 'facial recognition biometric, driver licence [sic] scan, signature, club membership data, address, birthday, phone number, club visit timestamps, slot machine usage.'