Visitors to a major shopping centre could have been scanned by facial-recognition cameras without knowing it, a civil liberties group said.
Big Brother Watch said the trial at Meadowhall in Sheffield was part of a UK-wide facial recognition "epidemic".
The shopping centre's owner said data was "deleted immediately" after the month-long police trial in 2018 ended.
The Information Commissioner said she was "deeply concerned" about the use of the technology in public spaces.
Elizabeth Denham has launched an investigation into a facial-recognition system being used in the King's Cross area of London.
Big Brother Watch's chief executive Silkie Carlo said: "There is an epidemic of facial recognition in the UK
"The collusion between police and private companies in building these surveillance nets around popular spaces is deeply disturbing," she said.
Meadowhall's owner British Land said it did not operate facial recognition at any of its sites.
"Over a year ago we conducted a short trial at Meadowhall, in conjunction with the police, and all data was deleted immediately after the trial," a spokeswoman said.
Big Brother Watch said the technology had also been used at Liverpool's World Museum, during the China's First Emperor and the Terracotta Warriors exhibition, and Birmingham's Millennium Point complex.
Ms Silkie said: "We now know that many millions of innocent people will have had their faces scanned with this surveillance without knowing about it, whether by police or by private companies."
Ms Denham said her office was monitoring the use of live facial recognition by commercial companies, including where they were working with police forces, to ensure data protection laws were being complied with.
"We'll consider taking regulatory action where we find non-compliance with the law," she said.
A spokesperson for South Yorkshire Police said the force "supported" the trial at Meadowhall "in order to develop a better understanding of opportunities associated with the use of this technology".
National Museums Liverpool said it had used technology during the exhibition due to a "heightened security risk" after consultation with Merseyside Police and counter terrorism advisors.
It said the use of facial-recognition cameras had been clearly signposted throughout their use.