The GDPR may be developing some teeth: a school in Sweden has been fined for using face recognition to take attendance.