The controversial facial recognition provider is facing a GDPR-based order from the French regulator CNIL, which would require it to delete French citizens from its database or face mounting fines.