China’s new data privacy law ‘will state how facial recognition can be used’