A few quick points:
A user can disable it by pressing together two buttons, therefore when handing it to anyone it won't work afterwards.
The Face ID data is not a photo of one's face but a mathematical calculation of the face features.
The data is stored ON THE PHONE, NOT THE CLOUD.
Full exlanation here, for idiots who flap gums with ignorance of facts:
http://appleinsider.com/articles/17/09/15/apples-craig-federighi-details-face-id-in-new-interview
Al Franken is an idiot, same questions as Touch ID, and same answers. If he cares so much about privacy, he should have watched the Keynote to find out and see how it works.