A company operating a facial recognition system in China has exposed millions of residents’ personal information online.