Is this in any way legal? I'm almost totally convinced this sort of intrusion and violation of privacy without cause is totally beyond what the police are allowed to do, even with the current trends toward this sort of thing in the U.K.

If one wanted to attend the festival without being subjected to facial recognition software, I might recommend masks from http://www.urmesurveillance.com/ or something similar. A number of sites selling "anti-facial-recognition" masks have opened in the last few years.