UK police fail to use facial recognition ethically and legally, study finds