Employees at a Midtown apparel firm say they were blindsided when the company ditched swipe-card time clocks for facial recognition scans — with no warning, no consent and no policy update. Privacy experts say the move could be invasive or even illegal.