That informed consent should be obtained seems obvious -- perhaps some of those people wouldn't want their faces to be used in that way. Are their desires without meaning? From the report, it also sounds like the images were being obtains in a plainly deceptive manner.
Whether or not there is "harm" is beside the point. The point is whether or not people are being deceived, and whether or not we as a society value meaningful autonomy.
People can take your picture, but there are longstanding legal privacy protections in place for how that picture can be used (for instance, commercial use is restricted). What I'm arguing is that those existing protections are no longer sufficient, and restrictions for use should include requiring having permission to include the pictures in databases as well.
But none of this is terribly relevant to the issue at hand. In this case, an actual transaction and apparent deception is involved.
EDIT: I guess you're reacting to my "it can't be" comment. That was an expression of personal outrage at the idea of being placed in a powerless position, not an assertion of fact. All kinds of really terribly things are possible, obviously.
