It would be quite a scandal, legally and socially, if it was discovered that a bank was creating a database of images of their customers without consent.
That's quite interesting! So in Canada, it seems PIPEDA means the banks can't use atm video footage to build client profiles. Cannot say the same for the US, unfortunately.
According to ChatGPT: Only Illinois, Texas, and Washington really constrain that, and Illinois is the only one with real teeth.