As mentioned in 2 above, you need to obtain consent if you don’t have a contract with the person or if you need it to comply with another law.
If you use biometric technology, you must ontain consent as it is regarded as Special Personal Information.